ferm: move policy decisions to base::firewall

We have ferm::conf, no reason to push that bit as a parameter in ferm.
This is a policy decision, labs may decide for example to have an
entirely different config...

Change-Id: I004d96762973042cb87020619b2ad4af71597ec1
Merge "ferm: move policy decisions to base::firewall" into production