[SPARK-2157] Enable tight firewall rules for Spark

The goal of this PR is to allow users of Spark to write tight firewall rules for their clusters. This is currently not possible because Spark uses random ports in many places, notably the communication between executors and drivers. The changes in this PR are based on top of @ash211's changes in #1107.

The list covered here may or may not be the complete set of port needed for Spark to operate perfectly. However, as of the latest commit there are no known sources of random ports (except in tests). I have not documented a few of the more obscure configs.

My spark-env.sh looks like this:
```
export SPARK_MASTER_PORT=6060
export SPARK_WORKER_PORT=7070
export SPARK_MASTER_WEBUI_PORT=9090
export SPARK_WORKER_WEBUI_PORT=9091
```
and my spark-defaults.conf looks like this:
```
spark.master spark://andrews-mbp:6060
spark.driver.port 5001
spark.fileserver.port 5011
spark.broadcast.port 5021
spark.replClassServer.port 5031
spark.blockManager.port 5041
spark.executor.port 5051
spark.standalone.client.port 5061 # not documented
spark.worker.watcher.port 5071 # not documented
spark.executor.env.port 5081 # not documented
```

Part of me is worried that the maxRetries parameter here is an effective cap on the number of concurrent shells/executors/drivers that can be run on one machine at once when in restricted firewall mode.  Because in Standalone mode each app gets its own set of executors across the cluster, this is a cap on the number of concurrent applications on a cluster.

What do you think of creating a config option, say spark.ports.maxRetries that can be set to change this?  I might change the default to be a bit higher, like 16 or so.

The way I'd expect network teams to run this then, is set spark.ports.maxRetries to say 20, and then open up a range of size 20 starting from each of the relevant ports in the config list you pasted in the summary