openstack: convert iptables to ferm

Convert the ugly (and internally broken) iptables rules to neat ferm
rules. It's still a bit convoluted as the individual roles are mixed
into a single class and IPs are hardcoded in that class. It's not a
regression, though, and a good first step :-)

Merged manually to reconcile with change
https://gerrit.wikimedia.org/r/#/c/102052/1

Change-Id: Ic0fe2010b5c884469dfa4c669cfe36e79f2e2fc5