Add --enforce mode to enroll diff and add --ignore-package-versions

If there is diff detected between the two harvests, and it can
enforce restoring the state from the older harvest, it will
manifest the state and apply it with ansible. Only the specific
roles that had diffed will be applied (via the new tags capability).

`--ignore-package-versions` will skip reporting when packages are
upgraded/downgraded in the diff.

release.sh

@@ -72,7 +72,7 @@ for dist in ${DISTS[@]}; do
   rm -rf "$PWD/dist/rpm"/*
   mkdir -p "$PWD/dist/rpm"
 
-  docker run --rm -v "$PWD":/src -v "$PWD/dist/rpm":/out -v "$HOME/git/jinjaturtle/dist/rpm":/deps:ro enroll-rpm:${release}
+  docker run --rm -v "$PWD":/src -v "$PWD/dist/rpm":/out enroll-rpm:${release}
   sudo chown -R "${USER}" "$PWD/dist"
 
   for file in `ls -1 "${BUILD_OUTPUT}/rpm"`; do