BZ#1122701 - Incoming ports are wide open

https://bugzilla.redhat.com/show_bug.cgi?id=1122701

Uninstall firewalld. The firewall puppet module will then take care of
installing iptables-services package and enabling and starting of
iptables. Default firewall rules will then be present.

Moving the disabling of firewalld to firewall::common so that it's
also ran for the Gluster server host group.
Ensure iptables runs before setting firewall rules

It used to happen that some firewall rules tried to be created before
iptables service was actually running, resulting in failure to create
the rules and printing warnings like:

Warning: Firewall[001 apache incoming](provider=iptables): Unable to persist firewall rules: Execution of '/usr/libexec/iptables/iptables.init save' returned 1:

This issue specifically appeared for apache, nova, and glance firewall
rules on the HA controller.

After updating firewall module, the warnings were not printed but the
iptables service was still getting started after some firewall rules
were defined by Puppet, and this caused the system default firewall
rules not to be present at all.

It seems we need to add ordering on every firewall resource definition
to really ensure that iptables service is started before the first
firewall rule is defined by Puppet. I tried couple other approaches
(adding the dependency into pacemaker::common for the HA controller)
but it didn't seem to work.

Leaving out classes that do not run with openstack_common class in
their hostgroups:

* hamysql::node, hamysql::singlenodetest,

* storage_backend::gluster (this one seems unused anyway, instead
  we're using quickstack::gluster::server nowadays).