feat(*): provision using CoreOS stable channel

[CoreOS 494.3.0](https://coreos.com/releases/#494.3.0) was promoted to stable today, so Deis should be able to settle there. Provider image IDs & AMIs were all updated except Rackspace, which hopefully refreshes later today.

Double-check IDs at https://coreos.com/docs/running-coreos/cloud-providers/ec2/ and https://coreos.com/docs/running-coreos/cloud-providers/google-compute-engine/. Refs #2613 and #2631.

Question: is https://github.com/coreos/coreos-overlay/commit/f6ae1a34d144e3476fb9c31f3c6ff7df9c18c41c going to supercede our `--insecure-registry` settings?
I've actually been on docker 1.3.0 lately (simply due to laziness and I'm not running this in prod):

```
core@deis-2 ~ $ docker version
Client version: 1.3.0
Client API version: 1.15
Go version (client): go1.3.2
Git commit (client): c78088f
OS/Arch (client): linux/amd64
Server version: 1.3.0
Server API version: 1.15
Go version (server): go1.3.2
Git commit (server): c78088f
core@deis-2 ~ $ systemctl cat docker
# /usr/lib64/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=http://docs.docker.io
Requires=docker.socket
After=docker.socket

[Service]
Environment="TMPDIR=/var/tmp/"
ExecStartPre=/bin/mount --make-rprivate /
LimitNOFILE=1048576
LimitNPROC=1048576
# Run docker but don't have docker automatically restart
# containers. This is a job for systemd and unit files.
ExecStart=/usr/bin/docker --daemon --storage-driver=btrfs --host=fd://

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/docker.service.d/50-insecure-registry.conf
[Service]
Environment="DOCKER_OPTS=--insecure-registry 10.0.0.0/8 --insecure-registry 172.16.0.0/12 --insecure-registry 192.168.0.0/16
```

The `--insecure-registry` flag doesn't seem to bother the daemon because it just skips past them. We definitely **strongly** recommend docker 1.3.2, but if you're aware of the risks then deis works fine on older versions.

> Should I change this callout to also mention stable channel?

It wouldn't hurt to do so :)