Fix: PE: Exclude resources and nodes from the symmetric_default constraint in some circumstances

This is particularly relevant to bundles where only specific nodes
are allowed to a particular resource. Previously, even if we set the
tuple up correctly during container_unpack(), common_unpack() would
re-add the full node set afterwards recursively via the parent.

Similarly, the bundle "nodes" are not eligable for running any other
resource than the one container_unpack() assigned it and there is no
reason to add it to their allowed_nodes list.

Keeping the allowed_nodes list concise also ensures crm_resource
--cleanup does the bare minimum necessary when the resource is in an
unknown state.