[queens] re-add ssh firewall rule

When the undercloud isn't containerized,
I89cff59947dda3f51482486c41a3d67c4aa36a3e isn't enough and we need to
add the rule in instack-undercloud.

It was removed in pre-rules: I14b540e6564c5b7c5d54b4f1fd5368b000744135
to allow more granularity for the operators.
Let's keep the functionality but still allowing ssh by default.

Change-Id: I3a5c1f558ba3ae639857f1a0596a6243a91d49e6
Related-Bug: #1826829

elements/puppet-stack-config/puppet-stack-config.yaml.template

@@ -929,6 +929,9 @@ nova::notify_on_state_change: 'vm_state'
 # Firewall
 tripleo::firewall::manage_firewall: true
 tripleo::firewall::firewall_rules:
+  '003 ssh':
+    dport:
+      - 22
   '105 ntp':
     dport: 123
     proto: udp