Use a hiera lookup instead of a non-existant global to restrict access

- Should restrict access to the outside world (not in Aviation house)
- We were never setting `::pp_only_vhost` in the global namespace
- hiera lookup should work on a per-environment basis
- Tested in VM, #TODO write a test around this!