root: Add root_password_hash parameter and ensure the password

manifests/init.pp

 class icinga_admin(
-  $users  = {},
-  $groups = {},
+  $users              = {},
+  $groups             = {},
+  $root_password_hash = undef,
 ) {
   validate_hash($users)
   validate_hash($groups)

manifests/root.pp

@@ -15,4 +15,15 @@ class icinga_admin::root
       ensure  => file,
       content => template('icinga_admin/bashrc.erb');
   }
+
+  if $::icinga_admin::root_password_hash {
+    validate_string($::icinga_admin::root_password_hash)
+
+    unless $::icinga_admin::root_password_hash =~ /^\$6\$.+\$.+/ {
+      fail('You can only use sha512 salt-hashed passwords for "root_password_hash"!')
+    }
+    user { 'root':
+      password => $::icinga_admin::root_password_hash,
+    }
+  }
 }