remove turing off of iptables.  new plan is just to document not
to use with a oppressive firewall.
tweaks to generation of foreman_client.sh.

* install rubygems from foreman repo for now to meet that dependency
  requirement.
* call "puppet agent" twice so that when we start the service, it
  should be fully initialized (cert pulled down and known to the
  puppet server).