ensure-pip: always check for python3-venv on Debuntu

As explained inline, we can have systems where pip is installed, but
python3-venv isn't.

This role is assuming that "python3 -m venv --help" indicates that you
will be able to create a working venv with this command, but this is
unfortunately incorrect.  On Debuntu this requires the python3-venv
package as well.  Put in an unconditional probe for this in the
workarounds, and install it if required.

Change-Id: Iaa3ecd05b64af6dd9b2ee17a39bcbe6cde8686ba

roles/ensure-pip/tasks/workarounds.yaml

@@ -16,3 +16,31 @@
     - ansible_python.version.major == 2
     - ansible_os_family == 'Suse'
     - ansible_distribution_major_version == '15'
+
+# Part of this role is exporting a working virtualenv_command for you
+# -- on Debuntu, the presence of venv (i.e. "python3 -m venv --help"
+# works) doesn't actually mean venv works ... that's just a stub that
+# will give you an error telling you the python3-venv package isn't
+# installed.
+#
+# It's quite possible we have pip and so have skipped installing from
+# packages, where we would have brought this in.  To avoid requiring
+# sudo, which is the whole point of probing for pip and skipping
+# install if we have it, we probe for the package here and only
+# install if required.
+- name: Check for python3-venv
+  command: dpkg --status python3-venv
+  failed_when: false
+  register: _deb_venv_pkg
+  when:
+    - ansible_os_family == 'Debian'
+
+- name: Ensure python3-venv
+  package:
+    name:
+      - python3-venv
+  become: yes
+  when:
+    - ansible_os_family == 'Debian'
+    - _deb_venv_pkg.rc != 0
+