Add a ferm service for ssh on all bastionhosts

This is done to ensure continuous SSH access on all bastion hosts
While at it, create a simple role class for bastionhost, and assign it
to all bastion hosts and delete older ssh rules marked to be removed

Change-Id: I61f2f9fcb6392ea13276748926fdc7f058f3fc2d