Currently, the allowed SSL ciphers for the fundraising infrastructure are hard-coded in playbooks and roles. They are all the same, but it's a lot of duplication. To achieve some consistency and be able to react to deprecations fast, we should put them in a variable in the all.yml file.

Note: Investigate if the ssh-hardening role described in T221210 fulfills that task.