Add rssh and base::packages class to Hiera

[rssh](http://www.pizzashack.org/rssh/) is a restricted shell for use with OpenSSH which allows us to lock down which programs can be run from which user. This pull request sets the default shell for the 'govuk-backup' user to rssh, and restricts rssh to running rsync jobs alone. This will have the effect of govuk-backup being limited to running only rsync jobs, and nothing else. It also increases security a bit, since the shell is a bit useless without permissions to do much/anything else.