icinga: allow private1-esams through firewall

private1-esams is 10.20.0.0/24, but we only allowed through 10.21.0.0/24
(esams mgmt) with the helpful label "private_esams". Expand this to the
full /15 which is (probably) where all of private esams is going to be.

Change-Id: I159195b47e122dc4440a79a81c6cb81b9109a586