Restrict bastion node update

[ioggstream]

I expect

that changing rhn_* configurations won't recreate the bastion node.

When using static root volumes, this could cause the stack to fall in an unrecoverable state

instead

those changes should be eventually ignored, and only changes to openshift configuration to be propagated via the deployment_run_ansible deployconfig.

This could be implemented via

https://docs.openstack.org/developer/heat/template_guide/environment.html#restrict-update-or-replace-of-a-given-resource

If you can provide some guidance, I'm willing to help.