Add simp/sssd module to harness

[jst-cyr]

Module

• Forge: https://forge.puppet.com/modules/simp/sssd
• GitHub: https://github.com/simp/pupmod-simp-sssd
• Forge name / version: simp-sssd 10.1.0
• Puppet requirement: openvox >=8 <9
• OS support: RHEL-family 8/9/10 (RedHat, CentOS, OracleLinux, Rocky, AlmaLinux)

Summary

simp/sssd was evaluated for the compatibility harness. It is a viable Puppet
Core 8 candidate, but its upstream acceptance tests cannot run in the harness's
single-SUT Docker model — the nodesets are Vagrant (VM) based, with no Docker
nodesets, and several suites require additional infrastructure hosts.

Because upstream acceptance tests exist but can't be exercised here, onboarding
now would mean an acceptance: blocked entry, which the dashboard's
is_fully_compatible() gate excludes from KNOWN_COMPATIBLE.md by design (see
scripts/render_status_dashboard.py). This issue queues the module for onboarding
once the harness gains VM-based / multi-host acceptance support.

Acceptance blocker

• Nodesets use the Vagrant hypervisor (no Docker nodesets ship with the module).
• Test suites beyond default need extra infrastructure:
  • ad — requires a Windows Active Directory server.
  • ds389 and ldap — stand up 389-DS / LDAP directory servers.

Notes

• Declares openvox as the dependency name. Per project convention this is a
  normal input (a warning, not an incompatibility) — the harness swaps
  OpenVox → Puppet Core.
• Depends on simp-beaker-helpers (~> 3.1) in the :system_tests group, which
  adds bootstrap complexity for any future acceptance wiring.
• OS targets are fine: the harness already has el9, el9-systemd, and el10
  setfiles. The blocker is topology (VM / multi-host), not OS.
• Not a duplicate: config/modules.json already contains
  voxpupuli/puppet-sssd, a different module from a different author. If
  added, this SIMP entry needs an explicit non-voxpupuli id.

Proposed action

• Onboard simp/sssd (unit + acceptance) once VM-based acceptance — and, for
  the ad suite, an AD server — is supported.
• Alternatively, add now as acceptance: blocked if unit-only signal is
  deemed worth the per-run time (accepts permanent "not fully compatible"
  status).