update install instructions now that LDAP/puppet are partly decoupled

It's not a big change, but it allows us to change the order in which
Puppet and LDAP are configured (now separately, and in that
order). It's also nice because LDAP is in a separate step now, which
can be done at any time, effectively.