Finer access control in os-volume_attachments

Allows policy.json access controls to authorize requests for specific
actions, rather than just being an all or nothing control for the entire
extension.

Bug 1108222
DocImpact
Change-Id: I78e1f596f22434a73bec3952ed024e4d58faac51
validate specified volumes to boot from at the API layer

This causes the create to fail fast instead of putting
the instance into error later in the process.

Related to bug: 1069904
Change-Id: I5f7c8d20d3ebf33ce1ce64bf0a8418bd2b5a6411
Add instance_fault_create() to conductor

This moves the use of db.instance_fault_create() from the compute
utils to conductor.

Related to blueprint no-db-compute

Change-Id: If089ce1623374a259a2d63a99befc46fa3a130b6
Merge "validate specified volumes to boot from at the API layer"
Merge "Finer access control in os-volume_attachments"
Merge "Add instance_fault_create() to conductor"