Migrate stored credentials to keystone trusts

Migrate the stored user_creds, which currently only supports
storing username/password credentials to use the keystone v3
API OS-TRUST extension, which allows explicit impersonation of
users calling heat (trustors) by the heat service user (the
trustee)

Note this feature is made optional via a new config option,
defaulted to off, and it requires the following patches to
keystoneclient (in 0.3.2 release) and keystone to work:

https://review.openstack.org/#/c/39899/
https://review.openstack.org/#/c/42456/

Also note that if the feature is enabled, by setting
deferred_auth_method=trusts in heat.conf, you must add
a keystone_authtoken section, which is also used by the
keystoneclient auth_token middleware.

blueprint heat-trusts

Change-Id: I288114d827481bc0a24eba4556400d98b1a44c09
Change _testnoexisthost_ references in tests

These dummy urls are obviously invalid, but could potentially trigger
unexpected failures due to the underscores.

Instead use RFC2606's recommended test TLD of '.test' ensures
that these will never resolve.

Change-Id: I2723b18ef3eba81ee8c8a22d866ceb79c00aad75
Merge "Migrate stored credentials to keystone trusts"
Merge "Change _testnoexisthost_ references in tests"