Make sure PrePuppet runs before any Deployment_Step

We used to have this in mitaka:
https://github.com/openstack/tripleo-heat-templates/blob/stable/mitaka/puppet/controller-post.yaml#L45

but we lost it along the way. The problem without this change is that we
are open to the following race:
1) ControllerDeployment_Step1 is started and manages to do a successful
   "systemctl start pacemaker"
2) PrePuppet gets called and in the HA deployment calls
   pacemaker_maintenance_mode.sh
3) pacemaker_maintenance_mode.sh will set the maintenance-mode=true
   property because the pacemaker service is already up:
   https://github.com/openstack/tripleo-heat-templates/blob/master/extraconfig/tasks/pacemaker_maintenance_mode.sh#L8-L9
4) If the maintenance property is set to true at this stage, the
   creation of any resource will take place but they won't really
   start.

NB: This is not a straight cherry-pick from
bae48e60b3 because in newton the file is
not called puppet/puppet-steps.j2.yaml, but it is puppet/post.j2.yaml
instead. And also because we need to only do this for the Controller
role.

Change-Id: Icb7495edd00385b2975dd42f63085d20292ef9a9
Closes-Bug: #1673795
Co-Authored-By: Jiri Stransky <jstransk@redhat.com>

puppet/post.j2.yaml

@@ -59,7 +59,11 @@ resources:
   # Step through a series of configuration steps
   {{role.name}}Deployment_Step1:
     type: OS::Heat::StructuredDeploymentGroup
+    {% if role.name == 'Controller' %}
+    depends_on: [ControllerPrePuppet, {{role.name}}PreConfig, {{role.name}}ArtifactsDeploy]
+    {% else %}
     depends_on: [{{role.name}}PreConfig, {{role.name}}ArtifactsDeploy]
+    {% endif %}
     properties:
       name: {{role.name}}Deployment_Step1
       servers: {get_param: [servers, {{role.name}}]}