remove sudo::appserver from bastions

- remove the include from bastion role
- add to fenari so nothing breaks there

bastion hosts are not supposed to be used for
deployment.

let's not have another fenari in the end

i would like this as a pre-requisite to
I922e4ee5e

if this breaks anything please tell me what

Change-Id: I82cabbe9f6faac4de3829bf5d20ca5e140d1c27a