include 'bastionhost' on bastion hosts

the existing situation is not consistent
- include "bastionhost" on bast4001 and iron
  they are bastion hosts so they should likely
  include the bastion host class
- bast1001 and fenari already include "bastionhost"
  this sets role "bastionhost" in the module init.pp
- do not set system::role it in site.pp directly
Change-Id: I922e4ee5ede0dd2af6dd88c89eaa76bf23b89dbc