[xenial] Add host firewall configuration change to permit _apt user to fetch packages

[eloquence]

Ubuntu 16.04 uses the _apt user instead of root to fetch packages. As part of the Xenial transition (#3204), we need to change the firewall rules on the app and mon servers to permit this user to access the network.

This will likely be done via a Debian package, so not admin intervention will be required; it will be installed even on Trusty since it is a harmless change.