Allow k8s edge health checks on arrstack hosts (#532)

The Kubernetes-hosted haproxy edge probes the arr/nzbget backends on `/consul/health`, but its traffic arrives SNATed from the node ranges rather than the DMZ edge, so nginx returns 403 and every backend health-checks down.

- Allow `198.18.21.0/24` (2.5gbe physical), `198.18.15.0/24` and `198.18.19.0/24` (node loopbacks) on the `arrstack_web_healthcheck` location.
- Keep `198.18.24.0/24` so the existing DMZ edge stays healthy through cutover.

---------

Co-authored-by: unkin-agent <agent@unkin.net>
Reviewed-on: #532
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/roles/apps/media.yaml

@@ -65,6 +65,9 @@ profiles::nginx::simpleproxy::locations:
       - 127.0.0.1
       - "%{facts.networking.ip}"
       - 198.18.24.0/24
+      - 198.18.21.0/24
+      - 198.18.15.0/24
+      - 198.18.19.0/24
     location_deny:
       - all
   # authorised access from external