fix: restrict ruby gem update task to ubuntu and handle failures gracefully

**Changed:**

- Clarified in documentation that vulnerable ruby gem dependencies are updated
  only on Ubuntu, as Kali handles CVE patches via apt
- Limited the gem update task to Ubuntu by adding a distribution check and
  explicitly excluding Kali
- Added `failed_when: false` to the gem update task to prevent task failure
  if the update process is killed or encounters issues
- Expanded documentation and task comments to explain the rationale behind
  these changes and the memory limitations during gem updates

Author: l50

ansible/roles/lateral_movement_tools/README.md

@@ -118,7 +118,7 @@ Install and configure lateral movement and credential extraction tools for Ares
 - **Create symlink for ffitarget.h in standard include path** (ansible.builtin.file) - Conditional
 - **Install rubyzip gem for evil-winrm dependency** (community.general.gem) - Conditional
 - **Install evil-winrm gem (Ubuntu only, Kali uses apt)** (community.general.gem) - Conditional
-- **Update vulnerable ruby gem dependencies (per-gem to bound memory)** (ansible.builtin.command) - Conditional
+- **Update vulnerable ruby gem dependencies (Ubuntu only - Kali patches via apt)** (ansible.builtin.command) - Conditional
 - **Install pth-toolkit (Kali only - may not be available in all repos)** (ansible.builtin.apt) - Conditional
 - **Warn if pth-toolkit installation failed** (ansible.builtin.debug) - Conditional
 - **Install Impacket from source for lateral movement tools** (ansible.builtin.include_tasks) - Conditional

ansible/roles/lateral_movement_tools/tasks/linux.yml

@@ -229,13 +229,16 @@
     - ansible_facts['distribution'] != 'Kali'
     - lateral_movement_tools_install_evil_winrm
 
-# Per-gem loop (not `gem update a b c d e`) to avoid OOM kill (rc=-9) during
-# parallel native-extension compile on the AMI build instance. `--no-document`
-# skips rdoc/ri generation, which is the heaviest memory hog.
-- name: Update vulnerable ruby gem dependencies (per-gem to bound memory)
+# `gem update` is skipped on Kali: evil-winrm ships via apt and Kali tracks
+# CVE patches for net-imap/rexml/uri/zlib through its `ruby-*` debs. On
+# AMI builders, `gem update` here also tends to SIGKILL (rc=-9) inside the
+# Image Builder runner regardless of `--no-document`, so we keep it
+# best-effort with `failed_when: false` and limit it to non-Kali Debian.
+- name: Update vulnerable ruby gem dependencies (Ubuntu only - Kali patches via apt)
   ansible.builtin.command: gem update --no-document {{ item }}
   become: true
   changed_when: true
+  failed_when: false
   loop:
     - net-imap
     - resolv
@@ -244,6 +247,7 @@
     - zlib
   when:
     - ansible_facts['os_family'] == 'Debian'
+    - ansible_facts['distribution'] != 'Kali'
     - lateral_movement_tools_install_evil_winrm
 
 - name: Install pth-toolkit (Kali only - may not be available in all repos)