contint: rsync host in labs

Creates role::ci::publisher::labs, an intermediary rsync hosts to have
the Jenkins slaves to push their build result.  Can later have the
production host gallium (which hosts doc.wikimedia.org) to fetch from
it.

The rsync is wide open. Labs only network communication inside the labs
project.  I have added a security rule to allow gallium to rsync.

Change-Id: I2044c7a2d3818da5fc9301cf8a36912922821af9