Ensure licks are executed from modules/dtg/files.

This is needed because we have to supply the absolute path of
$GIT_SSH. We build this by getting os.getcwd() and appending
ssh-no-fingerprint.

In future we could be more clever about finding ssh-no-fingerprint, or
better still adding lick as a package to the PPA. Patches accepted :-)
Merge branch 'master' of git:infrastructure/dtg-puppet
Bump version of firewall submodule.

It looks like this doesn't fix the non-deterministic application of
firewall rules, sadly. But it seems to work so we should use HEAD. Even
if for nothing else but being able to file respectable bug reports to upstream.