Open tcp/5666 on vSE

NRPE requires tcp\5666 to be opened on the vShield Edge in order for traffic
to flow. This commit does that, and restricts the traffic flowing
unidirectionally between the Icinga box and the off-site back-up box.
Set NRPE's allowed hosts

NRPE and Nagios interact using a client-server model, with NRPE being the server
and Nagios being the client. Nagios requests data from NRPE, hence why NRPE is
the server. NRPE is, in essence, a way to perform remote code execution so it is
especially important that we restrict which clients can connect to it and
perform code execution - anything that is not our production Nagios instance
should not be allowed to connect to it.

Our Nagios instance will respond, like all machines, from the SNAT IP in the
vSE - 37.26.90.227. It is, therefore, this IP that has been included in the
allowed_hosts directive. The inclusion of 127.0.0.1 is best practice, according
to the web, to allow for testing.
Create check_disk NRPE command in Hiera

The pdxcat/nrpe Puppet Forge module allows us to specify allowed NRPE commands.
This ensures that `allowed_hosts` are only allowed to run commands specified by
`allowed_commands`.

We set the arguments to `check_disk` in NRPE to ensure that, for security
reasons, arguments cannot be injected on-the-wire between monitoring host and
remote host.