Allow :override at cloud or base level

This allows creating default run list for rgossip and default firewall
rules for afw, for example.

Also shorten cluster and facet lookups, and remove unused var