split firewalld into separate role from server-secure

firewalld is important as the foundation of other roles (at least, once
I set up proper role dependencies for this playbook), fail2ban and
logwatch are not. So, I split off firewalld into its own role.

(Currently it just turns on the firewall with default settings, and
provides a "Reload firewalld" handler.)