handlers(docker): add once-per-directory docker compose pull with lockfile

- Introduced a new handler 'docker compose pull' that runs only once per
  {{ docker_compose.directories.instance }} directory by using a lock
  file under /run/ansible/compose-pull.
- Ensures idempotency by marking the task as changed only when a pull
  was actually executed.
- Restricted execution with 'when: MODE_UPDATE | bool'.
- Improves update workflow by avoiding redundant docker pulls during
  the same Ansible run.

Reference: ChatGPT discussion
https://chatgpt.com/share/68a55151-959c-800f-8b70-160ffe43e776

roles/web-svc-collabora/config/main.yml

@@ -2,6 +2,10 @@ server:
   domains:
     canonical:
       - "collabora.{{ PRIMARY_DOMAIN }}"
+  csp:
+    whitelist:
+      frame-ancestors:
+        - "{{ WEB_PROTOCOL }}://*.{{ PRIMARY_DOMAIN }}"
 docker:
   services:
     redis:
@@ -9,9 +13,9 @@ docker:
     database: 
       enabled: false # May this is wrong. Just set during refactoring
     collabora:
-      image: collabora/code
-      version: latest 
-      name: collabora
+      image:    collabora/code
+      version:  latest 
+      name:     collabora
 features:
   logout:   false 
   desktop:  true # Just set to allow the iframe to load it