The task files were previously renamed to .yml (commits b2379e5, ce7ec1b)
but main.yml's include_tasks directives still referenced the old .yaml
names, causing role execution to fail with 'Could not find or access'
errors for extra-packages.yaml, user.yaml, and ssh.yaml.
The bare 'password' variable in user.yml could silently collide with any
same-named variable elsewhere in scope. Rename to user_password to
namespace it alongside username.
BREAKING CHANGE: callers passing 'password' to this role must rename it
to user_password.