Commands to enable/disable a policy
config.yaml.sample (facts.blacklist): suppress a few more facts

Suppress some more facts that are in reality useless; some of these come
from a newer facter version (1.7.3) and will only come into play when we
update the microkernel from facter-1.6.18 to the latest released facter.
Move Razor::Data::Node::HW_INFO_KEYS to Razor::Config
Introduce config setting 'match_nodes_on'

This patch does not use the config setting; it only verifies that it is
sensible.
Match nodes only on hw_info entries that are given in match_nodes_on

The matching code assumes that any criterion (mac, serial, asset, uuid) we
match on is either unique or empty. Some vendors very smartly fill in some
of these values, e.g. asset tag, with a nonsensical value like "no asset
tag" or "to be filled by O.E.M". If we match on such asset tags, Razor will
assume that all machines with that asset tag are in fact the same machine,
and people are just changing hardware, e.g. NICs, frantically.

With this patch, users can select what criteria are used for matching nodes
based on their hardware information: the more criteria we match on, the
more reliable the mathcing is in the face of hardware changing (e.g., to
replace a defective NIC) This is limited by the fact that each criterion
must be empty or unique.

We default the match criteria to 'mac', i.e. only match on the MAC
addresses of the NIC(s) in the nodes. This is reliable unless _all_ the
NIC's in a node have to be replaced.

Fixes https://github.com/puppetlabs/razor-server/issues/59