provisioning: setup firewall dropping all connections directed outside of our CI network

All connections from our VMs to the outside internet should be dropped.

This is the only way to ensure that:

• our provisioning scripts do not depend on outside repositories
• an external dependency will not be introduced without us noticing
• a 3rd party server compromise won't directly affect our security