Implement Gerrit CLA and Contact Store.

This change fixes bug 1082754 and builds on the following prior
work, which set up the underlying mechanisms and implemented them on
review-dev:

  - https://review.openstack.org/12716
  - https://review.openstack.org/13058
  - https://review.openstack.org/13378
  - https://review.openstack.org/13392
  - https://review.openstack.org/13402
  - https://review.openstack.org/13592
  - https://review.openstack.org/14319
  - https://review.openstack.org/14493
  - https://review.openstack.org/16468

* manifests/site.pp(review.openstack.org): Add
gerrit_contactstore_appsec and gerrit_contactstore_pubkey variables
similar to those used for review-dev.openstack.org.

* modules/openstack_project/manifests/gerrit.pp
(openstack_project::gerrit): Move the cla_description, cla_file, cla_id
and cla_name variables here, since they'll be used by both review and
review-dev servers. Same goes for the set_agreements.sh file block and
set_contributor_agreements exec block. Also stop loading the
launchpad_sync module and make sure the sync_launchpad_users cron
job is removed from the server.

* modules/openstack_project/manifests/review.pp
(openstack_project::review): Add the contactstore_appsec and
contactstore_pubkey variables being from from hiera. Update the .war
file to one with "Hack out some CLA bits" reverted. Turn on
contactstore, pass the contactstore_appsec and contactstore_pubkey
variables through, and set the production contactstore_url.

* modules/openstack_project/manifests/review_dev.pp
(openstack_project::review_dev): Remove the definitions for
cla_description, cla_file, cla_id and cla_name, along with the
set_agreements.sh file block and set_contributor_agreements exec block
since they're all in gerrit.pp now.

Change-Id: I037f1a3e2b03c66768cec6caa7fe5e1c68495ac6
Reviewed-on: https://review.openstack.org/14099
Reviewed-by: James E. Blair <corvus@inaugust.com>
Reviewed-by: Monty Taylor <mordred@inaugust.com>
Approved: Jeremy Stanley <fungi@yuggoth.org>
Reviewed-by: Jeremy Stanley <fungi@yuggoth.org>
Tested-by: Jenkins