Do better at `resolved.conf`

Re-running `site.yaml`, these will always change:

- Early, set resolvers to only the master host for safety
  - `freeipa-install : Template /etc/systemd/resolved.conf with only master`
- Later, set resolvers to all FreeIPA hosts for redundancy
  - `etcd3-bootstrap : Template /etc/systemd/resolved.conf with all FreeIPA servers`

