Ensure iptables runs before setting firewall rules

It used to happen that some firewall rules tried to be created before
iptables service was actually running, resulting in failure to create
the rules and printing warnings like:

Warning: Firewall[001 apache incoming](provider=iptables): Unable to persist firewall rules: Execution of '/usr/libexec/iptables/iptables.init save' returned 1:

This issue specifically appeared for apache, nova, and glance firewall
rules on the HA controller.

It seems we need to add ordering on every firewall resource
definition. I tried couple other approaches (adding the dependency
into pacemaker::common for the HA controller) but it didn't seem to
work.

Leaving out classes that do not run with openstack_common class in their hostgroups:

* hamysql::node, hamysql::singlenodetest,

* storage_backend::gluster, firewall::gluster.