New IAM/EC2 policy conditions and keys - EUCA-7218

IAM/EC2 updates in support of allowing restriction of images to
specified availability zones. In addition to the EC2/Eucalyptus specific
condition keys support is added for Null, ..IfExists and ARN conditions.

Services can now provide an implementation of PolicyResourceInterceptor
in support of service specific resource related policy condition keys.
These implementations will be invoked prior to condition evaluation for
each resource.

Handling of null condition key values is updated for compatibility with
AWS IAM. The Null condition is handled specially for policy validation
as it is valid for use with any condition key.

A bug with condition key caching is addressed.

Volume and snapshot quantity metric functions are updated to avoid
loading entities into memory when evaluating quotas.

EUCA-7218
Add Capabilities utility and use for privileged DNS startup - EUCA-7371

A Capabilities utility class is added to support running tasks with the
expected capabilities for the process. The utility is used by the DNS
bootstrapper to ensure that ports under 1024 can be used.

EUCA-7371
Merge remote-tracking branch 'origin/dev/sjones/EUCA-7218' into testing
Merge remote-tracking branch 'origin/dev/sjones/EUCA-7371' into testing