hosts: do the right thing for VPN hosts
    
    Move the vpn ./. base logic from the ipa/client role into the hosts
    role, so that applying the latter doesn't apply the base profile on VPN
    hosts.
    
    Fixes: fedora-infrastructure#9822
    
    Signed-off-by: Nils Philippsen <nils@redhat.com>