Adding $ensure parameter to base::firewall

This makes it possible to remove base::firewall via puppet

Change-Id: I2ec0d72a44597804c42052114e5cf31713f871ae