make sure ceilo db_sync occurs in expected ha manifest
do not stop keystone on subsequent puppet runs

unfortunately, this also means we may start keystone if pacemaker had
stopped it, but this is the lesser of evils until the upstream
puppet-keystone brings back something akin to $manage_service.
pacemaker galera workaround

From a pacemaker expert, this workaround is necessary until resources
creation with --master and --clone are created in one step by the pcs
command (the update to the pcs package is imminent).
switch arrow type between execs

The "~>" arrow allows the thing on the right to be executed even if
the thing on the left is skipped.  This was bad for the two dep's
updated in this PR; e.g. we would see a glance db_sync failure even
if we saw something like:
  Exec[i-am-glance-vip-OR-glance-is-up-on-vip]: Skipping because of failed dependencies
when instead the db_sync shouldn't have even been attempted.