Make sure private underscore prefixed variables are not overridable by the user

[gardar]

Summary

Followup to #3452 and #3760

As underscore prefixed variables are supposed to be private/internal it would be great if the var-naming rule would make sure that the underscore prefixed variables can't be overridden (not defined in defaults/ )

It would also be great if it would be possible to enforce the use of underscore or double underscore prefix for all variables in vars/ and variables registered with register:

[cavcrosby]

I definitely think it would be a good addition for ansible-lint to throw violations if private/internal variables are set externally from the role. That said, I do initially think enforcing all variables under vars to be prefixed with an underscore to be a bit heavy-handed. I say this because I am under the impression variables under vars are just not typically overwritten, rather than that they shouldn't be. I suppose enforcing this for variables registered with register would be fine.