Add fail2ban

* Use a template to generate our local jail file
* Only significant change to template is inclusion of `@whitelist_ips` variable so that we can pull it from pp-deployment
* use sub-class pattern, sadly requiring the class to be called pp_fail2ban in order to avoid duplicate declaration errors
* Minor readme change to ensure librarian-puppet is installed