Adjust firewall rules for acme.i.o.o
    
    - allow ping in addition to ssh for all entries, needed for
      the connectivity check run before certificate deployments
    - add stage3 for deployment of the download.o.o certificate
    - reorder for better structuring
    
    Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>