move LDAP admin permissions,tools out of site.pp

- it's ugly to do this on the node in site.pp
- we want to find a replacement host for formey
- make a role out of the existing stuff, then move it

- removed sudo privs to run gerrit.sh
- removed full root for gerrit admin (because
  if needed that should be in the gerrit class)

- removed setting gid to 550
- removed $ssh_tcp_forwarding = 'no'
          $ssh_x11_forwarding = 'no'

(per comments on PS4)

RT #6134

Change-Id: I39f8f613f4266c1628d3692f9c2f446dbebf6d16