Change default flood limits

SYN and ICMP flood limits will be a little higher to stop accidental
blocking of legitimate traffic, for example from Debian Installer.
Add traffic forwarding support

This configuration is moved from other roles (kvm, lxc, openvz,
subnetwork) into ferm because some of the network forwarding
configuration from 'debops.subnetwork' (specifically, option to enable
Router Advertisements on forwarded interfaces) is required when
forwarding for KVM/LXC/OpenVZ virtul machines is enabled. To not
duplicate the code in all roles, it will be put in 'debops.ferm'
instead, and other roles can enabled it as needed using 'ferm_forward'
variable.
Merge pull request #16 from drybjed/forwarding

Change default flood limits, add forwarding configuration