installer: disable BIND zone transfers by default

Although not a direct security threat, allowing everyone to see all the
apps/gears that have been created is unnecessary and could assist
certain attacks. Admins who need to make zone transfers should know how
to change "allow-transfers"; others are secure by default.
installer: set tcp_tw_reuse on node hosts

As recommended elsewhere and investigated at length in
https://bugzilla.redhat.com/show_bug.cgi?id=1085115
this is a safe, effective performance tuning option. Without this in place
it is very easy (e.g. using "ab") to make a lot of very quick application
requests whose connections linger due to TCP defaults, eventually
blocking other connections from being created. Investigation indicated
it was safe in OpenShift scenarios to reuse these connections quickly
rather than waiting the default timeout.
installer: occlude gear dir

Keep gears from seeing what other gears there are in
/var/lib/openshift.
Merge pull request #463 from sosiouxme/2.1-security-hardening

2.1 security hardening
<openshift.ks> bz1140782 - improve replicaset config

configure_datastore_add_replicants fixes

Fix some logic and typos in configure_datastore_add_replicants.
Merge pull request #467 from detiber/bz1140782

<openshift.ks> bz1140782 - improve replicaset config
oo-install: avoid needing executable install scripts

This both simplifies the command and works with /tmp under noexec.
oo-install: improve question wording

At least one user was confused by the initial question about already
having a running broker. Tried to make this a little more obvious as
it's disorienting to a novice.
oo-install: do not restart_services needlessly [enterprise]

openshift.sh automatically restarts services after configuration, so
there is no need for oo-install to explicitly direct it to do so.