All the Puppet changes required for T303559 except the `/usr/bin/scap` symbolic link. The symlink will act as the switch when we are ready to phase out the scap deb package.
This includes, on both masters and scap targets:
* User/group `scap/scap`. On masters, the user will need to be able to ssh to scap targets. This seems to be achieved by adding ~~the new user to the `mwdeploy` and `deploy-service` Keyholder agents~~ a new identity to Keyholder and then configuring an agent for it in the Puppet config
* System dependencies: rsync, python3
On masters only:
* Checkout of the scap git repo at `/srv/deployment/scap`
* A way to query the list of scap targets -> https://gerrit.wikimedia.org/r/c/operations/puppet/+/771441
* /home/scap/scap needs to be accessible by rsync from all mediawiki and scap3 target hosts
* System dependencies: git, bash-completion, python3-venv