fix: Use always section instead of rescue to remove RHEL subscription (…

…#690)

Using a `rescue` section hides errors in the failed task. From docs:

> If an error occurs in the block and the rescue task succeeds, Ansible
> reverts the failed status of the original task for the run and continues
> to run the play as if the oriinal task had succeeded. The rescued task
> is considered successful

In this case we want the error to be propagated, and should use an
`always` section to ensure the machine is unregistered from RHSM.

ansible/provision.yaml

@@ -52,7 +52,7 @@
       - import_role:
           name: sysprep
         when: sysprep # make the finalize process skipable
-    rescue:
+    always:
       - name: Remove RHEL subscription
         block:
           - name: Remove subscriptions