Switch droplet to nyc2 for "private" networking interface

While not "private" in any meaningful sense, in that the
network is shared across the DC, it is useful to have a separate
interface when configuring the firewall for services supposedly
listening on a private subnet.

Also, sfo1 droplets were having performance issues.
Move droplet creation tasks into playbook
Add playbook to create bastion droplet
Add playbook to provision bastion