Run ensure-reno in pre, not run

It's installing stuff, let's run it in pre so we can get retries on
failures.

Change-Id: I39f47dc885c3e5b9aba66a571813386d45cc8e00

playbooks/releasenotes/pre.yaml

@@ -0,0 +1,4 @@
+- hosts: all
+  roles:
+    - ensure-reno
+    - revoke-sudo

playbooks/releasenotes/run.yaml

@@ -1,4 +1,3 @@
 - hosts: all
   roles:
-    - ensure-reno
     - build-releasenotes

zuul.d/jobs.yaml

@@ -288,6 +288,7 @@
       Publish the results of build-openstack-releasenotes to
       /afs/.openstack.org/docs/releasenotes/{{ zuul.project.short_name }}
     final: true
+    pre-run: playbooks/releasenotes/pre.yaml
     run: playbooks/releasenotes/run.yaml
     post-run: playbooks/publish/releasenotes.yaml
     override-branch: master