contint: migrate firewall rules to ferm

While at it, restrict ssh to gallium.wikimedia.org to internal hosts. We
will have to use one of the bastion as a proxy instead of sshing
directly.

Change-Id: Ie9be31bec57e70fc84bd59a5524e8f848bb61630
Merge "contint: migrate firewall rules to ferm" into production