Configure scap master and clients in beta

Deploy MediaWiki code changes from deployment-bastion to the rest of the
beta cluster using scap.

beta::scap::target
* Install authorized_keys for the mwdeploy user
* Configure pam to allow the mwdeploy user to access hosts from
   deployment-bastion
* Create /srv/common-local directory that scap will target

beta::scap::master
* Install ssh private key on deployment-bastion
* Setup rsync server
* Install and configure dsh
* Install wmf-beta-scap for running scap as mwdeploy easily

beta::scap::rsync_slave
* Configure rsync fanout servers for scap

beta::mwdeploy_sudo
* Manage sudo rights for mwdeploy which are needed by both
  beta::scap::target and beta::autoupdate

role::beta::rsync_slave
* Mount secondary disk at /srv
* Apply beta::scap::rsync_slave

* Include beta::scap::target in role::applicationserver::common which is
  used in role::applicationserver::appserver::{beta,jobrunner,videoscaler}
* Include beta::scap::master in role::beta::bastion
* Add ferm rule to beta::natfix that allows ssh from
  deployment-bastion.eqiad.wmflabs
* Change misc::deployment::vars to set MW_COMMON to /srv/common-local
* Change mediawiki::packages to manage symlinks from /usr/local/apache
  to various deployment directories.

This change assumes that a couple of things have been done to the
labs/private repository on the beta puppetmaster:
* files/scap/id_rsa and files/scap/id_rsa.pub are present
* File['/etc/ssh/userkeys'] in passwords::root changed to ensure file
  permissions of 0755.

These non-public changes have been made as a local commit to
/var/lib/git/labs/private on deployment-salt.eqiad.wmflabs

Bug: 63746
Change-Id: I8f77e0c131daa6147c22021ef08bf7dd2eab99a2