ntp: use explicit S2 upstreams

As noted in the ntp.pp comments this is less than ideal.
However, if we want to maintain "restrict default ignore"
(which is probably a good idea), we can't use pools
until we get the "restrict source" feature, which isn't
in a stable NTP release (much less distro package) yet.

Change-Id: I629b3de0d3424e21b6441a31bcb5bac11f87286e