Add basic inbound/outbound firewall, and a customised one for web hosts

New firewall, for review. Don't apply this to hosts yet :)

Current setup:

default DENY in and out
DNS & NTP allowed NEW outbound
SSH allowed NEW/ESTABLISHED inbound
SSH allowed ESTABLISHED only oubound
Puppet(8140) allowed NEW outbound

The web class adds https/rsync ports for yum and rsyncd

We can extend this further to the other hosts as time allows for testing what ports are required (eg I can imagine ci.theforeman.org will need outbound SSH state:NEW for Jenkins)

Thoughts?