firewall: nginx is allowed to query DNS (for OCSP stapling)

We will fix that later.
firewall: move lan definitions into hiera
firewall: fix ERB template for ips
firewall: use absolute path for IP objects
firewall: fix ERB template for ips
firewall: fix ERB template for ips (again)
dnsmasq: initial import
dnsmasq: enable dnsmasq module
dnsmasq: fix path to DNSSEC anchor file
dnsmasq: use `nogroup` group
firewall: ensure we are run last

We use users from other modules.
interfaces: WLAN interfaces will come through VLAN

The Intel Wireless 7260 doesn't support multiple SSID. We will use an AP
to add WLAN access.
interfaces: cope with the inability to get multiple SSID

And reduce the number of interfaces we have to handle.
debian: install more network packages
hostapd: initial commit
hostapd: enable hostapd
hostapd: use channel 11

ACS doesn't seem supported
hostapd: HT-40+ not compatible with channel 11
firewall: allow DHCP answers