feat: add AD drift reconciliation for passwords and group membership

[l50]

Key Changes:

• Introduced password and group-membership drift reconciliation so lab reset converges on the declared baseline instead of a superset, since both operations were previously add-only and left attack-run changes in place
• Added a repeatable -E/--extra-vars CLI flag across provision, ad-users, and lab reset, enabling ad_reconcile_check_only=true dry-runs to report drift without correcting it
• Reconciliation deliberately never touches cross-domain members, machine accounts, protected management accounts, or built-in principals (RID < 1000) to avoid over-correcting state not owned by the lab config
• Added comprehensive unit tests covering extra-vars parsing, precedence layering, and malformed-input rejection

Added:

• Group membership reconciliation - New reconcile_group_membership.yml diffs each lab-managed group against config and removes unexpected members via PowerShell, filtering foreign SIDs, computer accounts, built-in RIDs, and protected accounts
• Password reconciliation - New reconcile_passwords.yml authenticates each user with its configured password via LogonUser and resets only accounts that fail, including a credential probe that aborts if the host authenticates a nonexistent principal, plus lockout clearing and Protected Users handling
• Role defaults - New defaults/main.yml for the ad role defining ad_reconcile_passwords, ad_reconcile_group_membership, ad_reconcile_check_only, ad_reconcile_protected_accounts, and ad_multi_domain_groups_member
• Extra-vars support - Added parseExtraVars, applyExtraVars, and sortedPairs helpers in provision.go, wired the shared extraVarsUsage flag into provision, ad-users, and lab reset, and layered user vars over SOCKS tunnel connection vars
• Test coverage - New provision_test.go validating extra-vars parsing edge cases, precedence rules, caller-map immutability, and stable rendering
• Documentation - Documented the new role defaults and reconciliation tasks in the ad role README

Changed:

• Reconciliation task ordering - Wired the two reconcile passes into the ad role's main.yml after all add-member tasks, guarded by their enable flags, so they reconcile against a fully built baseline
• Multi-domain group data - Threaded ad_multi_domain_groups_member through ad-data.yml so the membership reconciler recognizes same-domain principals applied by the later groups_domains play as managed
• Provisioning signature - Extended provisionPlaybooks to accept an extraVars map, merged into the runner's ExtraVars, and added structured success/failure logging around playbook execution
• Reset command guidance - Updated lab reset help text and examples to explain that Stage 2 now reconciles rather than only re-applies, and how to rehearse with -E ad_reconcile_check_only=true