Add Ansible role to fix Drupal file permissions

Add a new `drupal-permissions` Ansible role that resets the file and
directory permissions to match the ones described in
https://www.drupal.org/node/244924.

This will later be released to Ansible Galaxy, but for now it will
remain in this repository until the required changes are made and the
appropriate documentation is added.

Fixes #191

tools/ansible/vars/deploy_vars.yml

@@ -9,7 +9,6 @@ ansistrano_shared_paths:
   - '{{ project_web_dir }}/sites/default/files'
 
 # Hooks
-ansistrano_after_symlink_shared_tasks_file: '{{ playbook_dir }}/deploy/after-symlink-shared.yml'
 ansistrano_after_update_code_tasks_file: '{{ playbook_dir }}/deploy/after-update-code.yml'
 ansistrano_before_symlink_tasks_file: '{{ playbook_dir }}/deploy/before-symlink.yml'
 
@@ -21,6 +20,16 @@ release_drush_path: '{{ ansistrano_release_path.stdout }}/vendor/bin/drush'
 release_web_path: '{{ ansistrano_release_path.stdout }}/{{ project_web_dir }}'
 release_theme_path: '{{ release_web_path }}/themes/custom/opdavies'
 
+drupal_permissions:
+  sites:
+    - root: "{{ release_web_path }}"
+      files_directories:
+        - sites/default/files
+      settings_files:
+        - sites/default/settings.php
+        - sites/default/settings.local.php
+  user: root
+
 drupal_settings:
   - drupal_root: '{{ release_web_path }}'
     sites: