Allow marking newly discovered nodes as 'installed'

This adds a configuration option, `protect_new_nodes`, which if set to a true
value causes all newly discovered nodes to be marked installed at the exact
same moment.

This will result in the default behaviour of Razor changing from "install
based on policy" to "install based on policy once a node reinstall is
explicitly requested", a much safer default for users.

By default Razor will continue to assume that it controls everything on your
network, and treat any newly discovered node as a candidate for immediate
installation according to policy.

https://tickets.puppetlabs.com/browse/RAZOR-152

Signed-off-by: Daniel Pittman <daniel@rimspace.net>