basic-system: Allow overriding /tmp mount options

Also, add 'nodev' while we’re at it.

basic-system/defaults/main.yml

@@ -10,3 +10,8 @@ journal_persistent_with_package: true
 logrotate_period: 'daily'  # 'weekly' is newer default
 logrotate_backlogs: 7  # default is 7 for daily, 4 for weekly
 common_sysctl_file: '/etc/sysctl.conf'
+tmp_mount_options:
+  - rw
+  - nosuid
+  - nodev
+  - noexec

basic-system/tasks/main.yml

@@ -5,7 +5,7 @@
     name: /tmp
     src: tmpfs
     fstype: tmpfs
-    opts: nosuid,rw,noexec
+    opts: "{{ tmp_mount_options|join(',') }}"
     state: mounted
   tags:
     - mount