Zabbix: split host creation into two tasks

Fixes idempotency, as PSK changes always report a change

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>

roles/zabbix/zabbix_agent/tasks/hosts.yml

@@ -29,10 +29,17 @@
         status: enabled
         state: present
         force: false
-        tls_accept: 2  # PSK
-        tls_connect: 2
+
+    # Zabbix API for PSK is write-only, so Ansible will always mark as "changed". Ignore "changed" state for PSK.
+    - name: "API | PSK keys"
+      community.zabbix.zabbix_host:
+        host_name: "{{ inventory_hostname }}"
+        tls_accept: 2     # PSK
+        tls_connect: 2    # PSK
         tls_psk_identity: "{{ zabbix_tls_psk_identity }}"
         tls_psk: "{{ lookup('ansible.builtin.file', private + '/files/zabbix/fedora' + env_suffix + '.psk') }}"
+      changed_when: false
+      ignore_errors: '{{ ansible_check_mode }}' # in check mode, the host might not be created yet
 
     # Most applications can add their own templates, but
     # the MGMT interfaces are part of the host properties