Doc: Clusters from Scratch, Pacemaker Remote: firewalld must be masked

"systemctl disable firewalld" is not sufficient when rolekit is used
to deploy a role that includes it. Use "systemctl mask firewalld" instead.