create admins::bastion for _just_ bastion access

We had this list of people who are
"supposed to be on bast1001 but are not in any other admin group".

Fix that and make a group an actual group.

Do not add people on the node and touch site.pp each time giving
somebody access.

Quite a few access requests ask for just one specific host or a
role that is applied to one or multiple hosts and as long as these
don't have public IPs (good), people need to also get bastion
access to jump over there.

Historically the "admins::restricted" group was used for that, but
over time that group has gained more access than _just_ bastion access.

For example it was on lucene boxes, until removed in I0013d5fd7e
and it still is on terbium and fluorine, though i suggest in
Iad35d5707d to remove that.

That meant that people who just needed access to something completely
unrelated effectively also got these additional permissions.

So first i wanted to make "admis::restricted" a class (again)
that just does bastion access but not more than that.

That would mean having to ask people who are currently in the
"restricted" group if they actually need fluorine/terbium though.
(or just merge Iad35d5707 and see who, if any, complains)

"bastion" as part of the name seems more obvious to me though
that it is supposed to mean "bastion access" but nothing else.

Change-Id: I61e34e2ee7aaf3ebffd27959bc45ae0d0fc2ac6e