Move tmpwatch from cron.daily to actual root crontab

It appeary running the tmpwatch from the cron.daily location isn't
possible: the way cron/anacron is running things appears to break
SELinux context at some point, leading to SELinux denials caused by a
weird need for dac_override.

In order to NOT allow this dac_override (security hazard), and after
extensive testing, it seems it's better to push the job directly in
root's crontab.

Change-Id: Ib7e1d47fe7cffa2bd2ed1d72d94e4f380162f10a
Closes-Bug: #1922002
Resolves: rhbz#1944466

deployment/logrotate/logrotate-crond-container-puppet.yaml

@@ -104,8 +104,10 @@ outputs:
       deploy_steps_tasks:
         - name: configure tmpwatch on the host
           when: step|int == 2
+          block:
+            - name: Push script
               copy:
-            dest: /etc/cron.daily/containers-tmpwatch
+                dest: /usr/local/sbin/containers-tmpwatch
                 owner: root
                 group: root
                 mode: 0755
@@ -119,6 +121,19 @@ outputs:
                     /var/log/containers/ 2>&1 | logger -t container-tmpwatch
               vars:
                  LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
+            - name: Insert cronjob in root crontab
+              cron:
+                name: "Remove old logs"
+                special_time: "daily"
+                user: "root"
+                job: "/usr/local/sbin/containers-tmpwatch"
+      update_tasks: &tmpwatch_script_clean
+        - name: Ensure old cron.daily is absent
+          when: step|int == 1
+          file:
+            path: /etc/cron.daily/containers-tmpwatch
+            state: absent
+      upgrade_tasks: *tmpwatch_script_clean
       # BEGIN DOCKER SETTINGS
       puppet_config:
         config_volume: crond