Store Gitea data (avatars, attachments, etc.) in Garage/S3

Also adds a new garage gateway role, which only allows RPC (inter-node)
traffic to Garage.

site-cookbooks/kosmos_garage/recipes/firewall_rpc.rb

@@ -0,0 +1,8 @@
+include_recipe 'firewall'
+
+firewall_rule 'garage_rpc' do
+  command  :allow
+  protocol :tcp
+  source   "10.1.1.0/24"
+  port     node['garage']['rpc_port']
+end