Allow nodes/roles to override states

Node and role definitions can now override states by prefixing them with
'~', effecting their deletion IFF already defined. They won't prevent
later additions of the state.

If a role 'base' defines the state 'firewalled', but host 'foo' cannot
use the default firewalling, then, this will eradicate the state from
foo's inheritance:

  roles:
    - base
  states:
    - ~firewalled

Signed-off-by: martin f. krafft <madduck@madduck.net>