role/logging: add ferm service webstats-collector

As outlined in Change-Id: Ibf3af60a8932325f1 we need
to add ferm firewall holes for all TCP services on nodes
having udp2log, so that later we can add base::firewall
with the default DROP policy and then get rid of the entire
old iptables class.

Change-Id: I02ee8d0f9564b03544b4ecb2605d3c3519fb78b5
Merge "role/logging: add ferm service webstats-collector" into production