better printer network security

[BNH440]

• add ipsec rules on all printers
  • fishpaper is a pretty good example of the correct way to do it, basically just only allow tule's ip for printing and allow all ip's access to the web interface
  • although currently fishpaper allows all management operations for any ip which exposes snmp publicly in the network which is bad, it should only be accessible by whatever host is pushing to the ocfstats db (which we haven't figured out, see fix lab stats page ocfweb#896
• have a secure password for admin operations on the printers and create an opstaff user with an easy to type password (because printer display keyboard sucks), that allows a few specific actions:
  • allowed actions:
    • reading supplies status and printer status (main web dashboard page)
    • accessing remote control panel from web dashboard
    • running a cleaning cycle
    • cancelling jobs