Increase size of connection tracking table

Increase size of connection tracking table

During high load, the default limit of the kernel connection tracking
table (65536) is often too low, resuling in error messages such as:

kernel: nf_conntrack: table full, dropping packet

This patch increases the limit to 500,000.

Since the nf_conntrack kernel module is not always loaded by default, it also
adds a mechanism to load kernel modules via hieradata using the kmod puppet
module. In order to express the needed dependency in puppet that kernel modules
are loaded before sysctl settings are applied, the Exec resources tagged with
'kmod::load' are specified in a resource collector to express that that Exec
resources with the tag should run before Sysctl resources.

Depends-On: I59cc2280ebae315af38fb5008e6ee0073195ae51
Change-Id: Iffa0a77852729786b69945c1e72bc90ad57ce3bb