ansible: add a wireguard role
This enables queueing jobs to remote farms as if they were in the local network! Unfortunately, only one farm can be connected to at a time, but we this can be addressed in a future series, by adding farm federation.
Wireguard peers are found at 10.42.100.XYZ, and to allow them to access the 10.42.0.XYZ, the commit changes the netmask from 10.42.0.255 to 10.42.255.255.