Reject all ICMP except echo-request and echo-reply

See merge request !3

refs sysadmin#17950

Hard-coded SSH accept was removed in: 5a5c91e0

refs sysadmin#17950

We have implemented SSH accept in all hosts via the profile.

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

We can't really use that syntax.

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

The puppetlabs-firewall module doesn't accept hostnames as values for
firewall rules.

refs sysadmin#17950

reverting the workaround in a994e098 as the dependency issue is fixed

For some reason, Puppet fails to load the Stdlib::IP::Address::V4::CIDR
type inside another defined type:

    Resource type not found: Stdlib::IP::Address::V4::CIDR

Let's workaround this for now by usign a String instead.

refs sysadmin#17950

This is a measure to make sure we have a way to start using this module
in production without causing too much pain.

This is not ideal but is also not a regression in relation to the
current firewall configuration:

  - VMs have no firewall at all and rely on the host.
  - Hosts already have SSH exposed to the whole Internet.

We should change this when/if we implement measures to protect SSH, for
example using an SSH JumpHost or a VPN.

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

refs sysadmin#17950

The original intention was to make it easier to use this module without
taking over a node's firewall config. But, as suggested during code
review, it indeed makes more sense that managing everything via Puppet
is the default and not the exception.

refs sysadmin#17950