NTP config refactoring + updates

Puppet-level stuff:
* Does not touch existing NTP classes
* Replaces the former classes ntp::client and ntp::server
  with a single define named 'ntp::daemon' that covers both
  cases equally via configfile template variables.
* Adds class role::ntp (to be included on virtually every
  node via base/standard), which includes our full NTP
  layout/configuration for WMF and sorts out the server
  and client variables within itself.
* Only on the new recdns boxes in site.pp for now (and a
  test client in codfw), will manually manage the push to
  those and fix up any issues before deploying wider and
  reaping the old classes/template

NTP-level stuff:
* Our new NTP servers are the 5x recdns servers (2x eqiad,
  2x codfw, 1x esams).
* All our NTP servers peer with each other, and upstream to
  the public NTP pool using a local zone (europe or us).
* All our regular clients use the internal servers from
  2x datacenters as their servers, and do not peer.
* Access controls tightened/fixed.

Change-Id: I797235f7605d274ef26f922f6e48546b0f1e6082