add base::firewall to ocg role classes

Change-Id: I193b24cbc8e48483486daa5fc5c1739b0411465a
Merge "add base::firewall to ocg role classes" into production