Fix dependency cycle in Puppet 3.7

In Puppet 3.7, `contain heat` from within quickstack::heat is going to
resolve to `contain ::quickstack::heat` instead of `contain ::heat`,
causing a dep cycle:

Error: Could not apply complete catalog: Found 2 dependency cycles:
(Class[Quickstack::Heat] => Class[Quickstack::Heat])
(Class[Quickstack::Heat] => Class[Quickstack::Heat])

In Puppet 3.6 the current code seems to behave correctly, and
furthermore it cannot cope with the fixed Puppet 3.7 syntax. If/else
branching based on Puppet version will break scenarios when using
different version of Puppet server vs. Puppet client. (Not a usual
scenario, but we shouldn't break it if we don't have to.)

Use `anchor` approach in the problematic spot, more info at:

https://docs.puppetlabs.com/puppet/3.7/reference/lang_containment.html#faux-containment-for-compatibility-with-puppet--340
cinder: fix class cycle dependency
BZ #1084229 - Add support for configuring SSL for RabbitMQ

https://bugzilla.redhat.com/show_bug.cgi?id=1084229

Pass the value of $ssl as rabbit_use_ssl to the nova and cinder
services
Merge pull request #362 from jistr/dep_cycle_on_contain

Fix dependency cycle on Puppet 3.7
Merge pull request #369 from gabrielecerami/cinder-cycle-dep-fix1

cinder: fix class cycle dependency
BZ #1156183 - open ceph ports on ceph storage node

https://bugzilla.redhat.com/show_bug.cgi?id=1156183

Open osd-related ports on ceph storage node.
Merge pull request #395 from cwolferh/add_ceph_osd_firewall

BZ #1156183 - open ceph ports on ceph storage node
BZ #1156342 - Memcached port not being opened in HA deployments.

https://bugzilla.redhat.com/show_bug.cgi?id=1156342
Merge pull request #397 from jguiditta/bz1156342-memcache-port

BZ #1156342 - Memcached port not being opened in HA deployments.
BZ #1157340 - need to rerun puppet to deploy heat on HA Controller

https://bugzilla.redhat.com/show_bug.cgi?id=1157340

Make sure dependent pacemaker services are really created within
quickstack::pacemaker::resource::service (so that other puppet
manifests may make the assumption the pacemaker resource exists after
a declaration of quickstack::pacemaker::resource::service).

(cherry picked from commit 96aa6e7539b301309fb93a0488034deb1418d692)
BZ #1088613 - Add Ceilometer Service to HA hostgroup.

https://bugzilla.redhat.com/show_bug.cgi?id=1088613

Add Mongodb to HA configuration.
Remove firewalld package declaration

This is now handle in the upstream openstack puppet module
Change mysql to use new override_options hash

The config_hash param becomes override_options. root_password is a
specific option now.
Galera back to functional for HA Controller / Juno

Caveats:
* ssl will not work (crt's are not included in galera rpm)
* do to lack of clustercheck, haproxy will not detect when
  a node loses quorum and should not receive requests
Update to use new mysql_* providers
Replace manage_service param with service_provider

NOTE: This MUST be fixed. The service provider needs to be something
other than undef.
Remove deprecated swift proxy params
create keystone heat role on just one HA node

to avoid an error message that the role already exists
Adds Hiera YAML data for HA

- YAML data set
- Embedded (module-data)

Tested against RHOS5/RHEL7
Merge pull request #391 from gildub/HA+Hiera

Adds Hiera YAML data for HA