deploy-proxy: Add pre-install validation for required parameters and certificate bundle #614

Problem

When running foremanctl deploy-proxy without required parameters or with invalid inputs, the deployment fails deep into the playbook execution with unclear Ansible errors instead of failing early with user-friendly validation messages.

Two specific cases identified during testing of #571:

1. Missing required parameters (--certificate-bundle, --foreman-fqdn)

Running deploy-proxy without --certificate-bundle or --foreman-fqdn causes a late failure in the Pulp role ("Configure Foreman Proxy" task) instead of a clear validation error upfront.

Ref: #571 (comment)

These parameters are required on first run but not on subsequent runs (values are persisted). The current obsah constraint system doesn't support "required on first run only" semantics, so traditional required constraints can't be used directly.

2. Nonexistent certificate bundle path

Running deploy-proxy --certificate-bundle ~/mycerts with a nonexistent path fails late in the playbook. The validation in extract.yml does check for the file, but only when --foreman-fqdn is also provided. Without --foreman-fqdn, the deployment fails on an unrelated task first.

When both --foreman-fqdn and an invalid --certificate-bundle are provided, the existing validation works correctly.

Ref: #571 (comment)

Suggested improvements

As discussed in #571, pre-install checks that fail fast would improve the user experience:

• Validate that certificate_bundle path exists (and possibly that it's a valid tarball)
• Validate that foreman_fqdn is reachable (network connectivity check)
• Consider adding "required on first run" constraint support in obsah, or implement a pre-flight check in the deploy-proxy playbook that verifies essential parameters are present when no prior deployment exists

Context

These parameters are intentionally not marked as required because on subsequent runs the user should be able to run foremanctl deploy-proxy --add-feature bmc without re-specifying the bundle and FQDN (they are persisted from the first run).