logging: replace rsyslog with logstash-forwarder

we should make cert placement its own reusable role.  this is not DRY as it is.