ocf_www: don't include common::mysql if mysql host

If a host has both ocf_www and ocf_mysql classes, we'll get a conflict
on /etc/my.cnf since common::mysql and ocf_mysql both try to provide it.
common/ldap: cleanup manifest, remove old cacert

We now use a certificate signed by an actual CA (see 7ed95de8dc), so
don't need to provide the old self-signed cacert.pem.
common/access.conf: allow root login from offsite

offsite will want to rsync files (and otherwise have root, just in
case). This will be reverted in a couple weeks when no longer needed.
sudoers: add nopasswd option for sudoers access

This sets NOPASSWD in the sudoers entry for ocfstaff (and owners) for
staff VMs, the rationale being that people without ocfroot have root on
these, and so staff should not be entering their passwords on them.

I originally did this on the desktops as well, but later decided against
it since:
  - it's likely staff leave themselves logged in by accident on desktops
  - staff will need to enter password to log in anyway

This is actually not the reason I did this; it will be used on the
offsite server, since we won't have Kerberos to verify passwords when
firestorm is down.