add ferm rule to only allow nrpe/5666 from intern

RT #6342

PS2: i had it in role/gitblit
PS3: decided it should be in nrpe itself,
     then you can include nrpe in the gitblit role

Change-Id: I84658abc260664df4be29a72749518d780329855