beta::natfix removal step 2

Kept the rule used on the beta cluster which allow ssh from the deploy
host (bastion) to the scap target.  Moved it to role::beta::scap_target

Change-Id: I6be9ab57b9ac92973b5568c8db522ae97537551e