contint: apply beta natfix on Jenkins slaves

The browser tests running on Jenkins slaves need to be able to access
the beta cluster.  Hence we have to rewrite outgoing packets due to how
NAT works in labs, that is being done by the role::beta::natfix class
which use ferm.

Since the default policy of ferm is to drop, define a rule that allow
gallium (Jenkins master) to ssh to the box.

Change-Id: I2aed0e2cf0de0480f1cf3da92c6f2b42134d1251
contint/beta: set natfix for the labs shared proxy

To save up public IP on labs, we have a shared proxy which has public IP
208.80.155.156 and private IP 10.68.16.65.  We have some browsertests
running on Jenkins labs instance that runs against labs instance
maintained by other teams.  So we better have to be able to reach them
directly.

Change-Id: I5886bee1ed3a667cd8492dbfe979519a4026fa82
Merge changes I5886bee1,I2aed0e2c into production

* changes:
  contint/beta: set natfix for the labs shared proxy
  contint: apply beta natfix on Jenkins slaves