Add Flatcar VM for cisa-kev-rss on goose (#4)

Provision a dedicated Flatcar host that runs the CISA KEV RSS container
from GHCR, with a dozzle agent and hub remote entry like the other VMs.

Co-authored-by: Cursor Agent <[email protected]>

butane/cisa_kev_rss.yaml

@@ -0,0 +1,52 @@
+variant: flatcar
+version: 1.0.0
+
+# CISA KEV RSS feed. Turns the CISA Known Exploited Vulnerabilities catalog
+# into an RSS 2.0 feed (https://github.com/xsaveopt/cisa-kev-rss).
+#
+# Feed:  http://192.168.7.64:3000/rss
+# Health: http://192.168.7.64:3000/health
+#
+# Stateless: the container refreshes from CISA every ten minutes and keeps
+# nothing on disk, so it is safe to rebuild at any time.
+
+systemd:
+  units:
+    - name: cisa-kev-rss.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=CISA KEV RSS feed
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=/usr/bin/docker pull ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStartPre=-/usr/bin/docker rm --force cisa-kev-rss
+        ExecStart=/usr/bin/docker run --rm --name cisa-kev-rss \
+          -p 3000:3000 \
+          ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStop=/usr/bin/docker stop cisa-kev-rss
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
+    - name: dozzle-agent.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Dozzle Agent
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=-/usr/bin/docker rm --force dozzle-agent
+        ExecStart=/usr/bin/docker run --name dozzle-agent \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -p 7007:7007 \
+          amir20/dozzle:v11.1.1 agent
+        ExecStop=/usr/bin/docker stop dozzle-agent
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target