Add `harden` module to Puppetfile

Harden is a Puppet module to secure a base installation of Ubuntu. Details can
be found at http://github.com/alphagov/puppet-harden. This commit adds Harden to
the Puppetfile to secure the host machine.
Adds 'harden' class to Hiera

In order to make use of 2c58258, we need to add the `harden` class to Hiera, as
this repository uses Hiera as a lightweight ENC.
Add blom/rssh module to Puppetfile

rssh (http://www.pizzashack.org/rssh) is a restricted shell for use with
OpenSSH. It allows us to lock down which programs can be run by which users from
the shell.

This commit adds the rSSH module in to the Puppetfile.
Allows rsync in rssh

The rssh Puppet module was added in be7e918, so this commit adds an rssh.pp
manifest in order to configure rssh.

This commit adds an `allow` attribute to the rssh class in order to specify that
only rsync should be allowed. Full details on the values the `allow` attribute
can accept are at https://forge.puppetlabs.com/blom/rssh.
Add rssh to packages manifest

This commit adds the `rssh` module to the packages manifest to ensure that rssh
is present when a Puppet run completes. If it is not present, Puppet installs
it.
Adds base::packages to Hiera

In order to use the packages.pp manifest, we need to add it to the list of
classes autoloaded by Puppet, which is defined within an array in Hiera. This
commit adds the `base::packages` class to the Hiera array.
Add `attachmentgenie/ssh` module to Puppetfile

This commit adds the `attachmentgenie/ssh` module to the Puppetfile. We use this
module due to the level of customisation it affords to us.
Add SSH class to Hiera

This commit adds the 'attachmentgenie/ssh' module to the list of classes used in
Hiera. We add this here as we are using Hiera as a lightweight ENC, rather than
the more traditional method of creating an `init.pp` file.

The module contains two classes - `ssh::client` and `ssh::server`. Adding
`ssh::server` in to Hiera to begin with - we can add the client if we decide to
change how we run rsync (currently push-based).
Add `ufw` module; create f/w rules in Hiera

This commit:
- adds the `attachmentgenie/ufw` module to the Puppetfile and Hiera
- adds firewall rules (0.0.0.0/0:22) to Hiera
Tidying up with librarian-puppet
Improve `rssh` configuration

Previously, the `rssh` configuration was being driven by a Puppet manifest.
Testing showed that this didn't work too well, because whilst it was not
possible to get shell access as that user, it was not possible to use rsync as
that user - which it should have been. Investigation showed that it was rssh's
default behaviour to restrict all access to that user unless there is an
rssh.conf configuration file.

This commit adds a configuration file for `rssh`, allowing only rsync, however
keeping the configuration options for other methods included in the file (but
commented out), to make it easy to enable them in future if required. It also
adds the file to the user.pp Puppet manifest so that it is actually created
during a Puppet run.

This tests out fine now.
Install and configure `rssh` using Hiera

Previously, we have been installing and configuring `rssh` somewhat manually.
This commit removes our reliance on manual installation, instead ensuring that
it is installed and configured using Hiera.