Move firewall control to separate variable

Previously access to NTP service through firewall was controlled by
value of 'ntp_listen' variable. However because it's a list and use of
these to pass boolean variables through role dependency variables is not
reliable, a separate variable just for this purpose was defined instead.
You still need to specify a list of interfaces to listen on to bind on
them for network access.