cr/firewall: allow access to new AQS hosts
The new Cassandra 3.11-based AQS cluster contains new hosts which need
to be accessed on port 9042 for data loading from the analytics
workers. Only the -a and -b hosts need access granted, cassandra
doesn't listen on 9042 on the aqsNNNN base hostnames.