Fix GSS-TSIG dns authentication

Somewhere along the way broker_dns_gsstsig class parameter got refactored out by mistake so we were never
attempting to deploy a kerberos based nsupdate config.

Fixed by :
  * Using kerberos nsupdate config whenever bind_krb_principal != ''
  * Remove the composition of "DNS/$bind_krb_principal@$broker_krb_auth_realms" because folks may use
  different realms for broker and dns auth. Also, we're naming the variable 'principal' so lets just have
  users provide a principal. There's risk here that folks would expect the previous behaviour, but given that
  the code path would never have been executed as it was I think this is a sane change.
Refactor openshift-origin-dns-nsupdate.conf creation
fixes for register_dns

- do not attempt to update dns records for hosts that are not a member
  of the host domain ($dns_infrastructure_zone if set, otherwise
  $domain)
- fix bug where nsupdate was being run against the $domain variable
  if $dns_infrastructure_zone is set.
- remove extra spaces output from register_dns.erb template
!fixup
Merge branch 'mcollective_ssl' of github.com:andrewklau/puppet-openshift_origin into mcollective_ssl