install: apply oo-gear-firewall by default

By default oo-gear-firewall is run to create iptables and selinux
isolation rules. Can be disabled as needed.
Needed to bump ulimit for semanage oo-gear-firewall rules.
install: time/datestamp some slow operations