Temporarily punch holes for hooft and bast4001

hooft and bast4001 are technically bastion hosts however they do not
have that class applied to them. Moreover that class would not punch
holes right now cause it lacks the corresponding rules. An effort for
that is at gerrit #96424.
In the meantime punch holes directly in site.pp for this and two (2)
other 2 unpuppetized services (rsync/udpmcast). Finally create
ferm::rule resources for ganglia aggreator that will only be realized
on hosts that include base::firewall

Change-Id: I055e9b0bc1c7a0b5fc6a3d4f307aaa964060d08b