Use dnf allow_downgrade for openssl EL9 workaround

ansible.builtin.package with state: present won't downgrade when a
newer version is already installed. Switch to ansible.builtin.dnf with
allow_downgrade: true so the pinned NVRs actually replace the broken
3.5.7-1 packages.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: zjhuntin

roles/vagrant_workarounds/tasks/main.yml

@@ -26,11 +26,12 @@
     - ansible_facts['distribution_major_version'] == '9'
 
 - name: force downgrade to openssl-3.5.5-3.el9
-  ansible.builtin.package:
+  ansible.builtin.dnf:
     name:
       - openssl-3.5.5-3.el9
       - openssl-libs-3.5.5-3.el9
       - openssl-fips-provider-3.5.5-3.el9
+    allow_downgrade: true
     state: present
   when:
     - ansible_facts['os_family'] == 'RedHat'