Unify nextcloud/sqlite/gpg_key/ipa_diff plugins + safe fixes + tests

[markuslf]

Phase 5 (final family): the nextcloud_occ_* modules, sqlite_query, gpg_key, and the ipa_diff module_util. This completes the in-house plugin unification (vendored ipa* / lvm_pv / gnupg stay as-is).

Style unification (no behavior change)

• Standard Linuxfabrik file header on all six files (ipa_diff had none).
• Single quotes, f-strings (replacing the last .format() calls in sqlite_query and gpg_key), ansible.module_utils.common.text.converters instead of the deprecated _text, fixed import ordering in sqlite_query, from __future__ without parens.
• Removed leftover Ansible-template boilerplate comments (nextcloud config modules), commented-out debug code (gpg_key), the no-op f prefix on placeholder-less strings, and the (object) base class (ipa_diff).

Security

• gpg_key no longer passes input_data (which contains the cleartext passphrase) into fail_json when key generation fails.

Safe fixes

• sqlite_query: a REGEXP query against a column containing NULL no longer raises (NULL simply does not match); bare except: narrowed to except Exception:; mutable default argument replaced with None.

Deferred (behavior-changing, separate PRs)

• sqlite_query reports a failed query as a successful run (the select() success flag is ignored in main()).
• nextcloud_occ_app_config array values are compared as str(list) vs JSON string and never match (needs verification against real occ output per the empirical-facts rule).

Tests

• test_ipa_diff.py (pure diff helpers), test_sqlite_query.py (connect / select / regexp / close against a real temp DB, incl. the NULL-REGEXP case), test_gpg_key.py (match_key).

Validation

• Full tox matrix green (94 tests across 13 envs).
• ansible-doc renders all five modules; the doc guard passes.
• pre-commit (bandit, vulture, pytest) green.