Ensure iptables runs before setting firewall rules

It used to happen that some firewall rules tried to be created before
iptables service was actually running, resulting in failure to create
the rules and printing warnings like:

Warning: Firewall[001 apache incoming](provider=iptables): Unable to persist firewall rules: Execution of '/usr/libexec/iptables/iptables.init save' returned 1:

This issue specifically appeared for apache, nova, and glance firewall
rules on the HA controller.

After updating firewall module, the warnings were not printed but the
iptables service was still getting started after some firewall rules
were defined by Puppet, and this caused the system default firewall
rules not to be present at all.

It seems we need to add ordering on every firewall resource definition
to really ensure that iptables service is started before the first
firewall rule is defined by Puppet.