Convert firewall rules to use TripleO-Ansible

This change converts our filewall deployment practice to use
the tripleo-ansible firewall role. This change creates a new
"firewall_rules" object which is queried using YAQL from the
"FirewallRules" resource.

A new parameter has been added allowing users to input
additional firewall rules as needed. The new parameter is
`ExtraFirewallRules` and will be merged on top of the YAQL
interface.

Depends-On: Ie5d0f51d7efccd112847d3f1edf5fd9cdb1edeed
Change-Id: I1be209a04f599d1d018e730c92f1fc8dd9bf884b
Signed-off-by: Kevin Carter <kecarter@redhat.com>

deployment/sahara/sahara-api-container-puppet.yaml

@@ -86,6 +86,11 @@ outputs:
     description: Role data for the Sahara API role.
     value:
       service_name: sahara_api
+      firewall_rules:
+        '132 sahara':
+          dport:
+            - 8386
+            - 13386
       monitoring_subscription: {get_param: MonitoringSubscriptionSaharaApi}
       config_settings:
         map_merge:
@@ -105,11 +110,6 @@ outputs:
                   "%{hiera('$NETWORK')}"
                 params:
                   $NETWORK: {get_param: [ServiceNetMap, SaharaApiNetwork]}
-            tripleo::sahara_api::firewall_rules:
-              '132 sahara':
-                dport:
-                  - 8386
-                  - 13386
       service_config_settings:
         rsyslog:
           tripleo_logging_sources_sahara_api: