firewall: move "allow NTP" rule to role::ntp

The otherwise generic "ferm" module had an "allow ntp" rule, as
introduced by commit 4e9f095. That's pretty ugly, so move it to
role::ntp instead, where it belongs.

While at it, there is no reason to have NTP open on the firewall on
every host. Stateful tracking of the outgoing connection should be
enough for clients, so move the stanza only under the server portion of
the role configuration.

Change-Id: I37d7443d3a5acb7cb0c591e77555fefd6f1a510e