installer: disable BIND zone transfers by default

Although not a direct security threat, allowing everyone to see all the
apps/gears that have been created is unnecessary and could assist
certain attacks. Admins who need to make zone transfers should know how
to change "allow-transfers"; others are secure by default.
installer: set tcp_tw_reuse on node hosts

As recommended elsewhere and investigated at length in
https://bugzilla.redhat.com/show_bug.cgi?id=1085115
this is a safe, effective performance tuning option. Without this in place
it is very easy (e.g. using "ab") to make a lot of very quick application
requests whose connections linger due to TCP defaults, eventually
blocking other connections from being created. Investigation indicated
it was safe in OpenShift scenarios to reuse these connections quickly
rather than waiting the default timeout.
installer: occlude gear dir

Keep gears from seeing what other gears there are in
/var/lib/openshift.
Merge pull request #465 from sosiouxme/2.2-security-hardening

2.2 security hardening equivalent to 2.1 in https://github.com/openshift/openshift-extras/pull/463