Advanced Firewalling feature

This patch enables Firewalling in this Puppet modules in a flexible way.

* Enable firewalling optionnaly (disabled by default).
* Enable 'pre' firewalling with defaults rules.
* Enable 'post' firewalling with DROP rule, with a debug option to
  disable it.
* Enable default rules for all services (OpenStack, etc).
* Ability to add custom firewall rules with Hiera
* Update puppetlabs-firewall refs
* Refactorize unit-tests
Question : Not specific to heat_cloudwatch, but don't you think here that different services might have different firewall_settings, I would agree that they all default to a common set, but if a user want to specify specific rule for specific service I think we should let the user do that.