1. Blacklist Ansible 2.9.8

Ansible 2.9.8 includes a regression on the fileglob plugin [1] that
causes the Kolla Ansible HAProxy role to fail.

This change blacklists Ansible 2.9.8 to work around the issue.

2. Use ensure-docker role instead of install-docker

The install-* roles are being deprecated and renamed to follow the
ensure-* naming convention [2].

[1] https://github.com/ansible/ansible/issues/69450
[2] http://lists.zuul-ci.org/pipermail/zuul-announce/2020-April/000071.html

Change-Id: Iab1d84e6a8c1b3dd81e53279309153687677a061
Story: 2007659
Task: 39748

This allows us to remove the sudo from the tox molecule environment, since
the install-docker role correctly adds the zuul user to the docker group.

Change-Id: Ib7abd22c0caf793a8a59d38a4f63df7e60a7b69e

Adds the following zuul job:

kayobe-tox-molecule

It runs ansible role tests using the molecule framework.

Note that we are currently running tox as root to work around issues
with applying docker group membership in the Zuul CI environment.

The ubuntu-1604 platform has been removed because the job takes a long
time to run even on one platform.

Change-Id: I8be24be828c0e124d822d7b39a02169c92b81eb3
Story: #2001637
Task: #6646