Adds a meta-state that sets up ordered component server states

Additionally, changes the default 'somepass' root password which is a security concern since a mistyped pillar key or no pillar key would leave servers exposed with the same default password.

This is not one of my 'ng' treatments but such might appear later when helium releases. A new branch on our repo contains a few other helium changes, notably:

- a test state that always fails to notify formula users if they have neglected to include a root pillar password
- switching test.rant_str to the new random.get_str method which is more cryptographically secure