fix firewall rules with multiple network hosts

If CONFIG_NETWORK_HOSTS contained hosts other than
CONFIG_CONTROLLER_HOST, the fact that the config keys for Neutron API
access...

    config['FIREWALL_PORTS'] = "'9696'"

...were set outside the 'for host in q_hosts' loop meant that they could
be overwritten by the tunnel-related configuration later on in the loop.
This patch sets the keys immediately before reading in the firewall
template.

See also: https://bugzilla.redhat.com/show_bug.cgi?id=1105248

Change-Id: I71f50b9aadab6f903ee0941deae2f13ed3467104