Remove roles from OS-TRUST list responses

According to the docs, the list responses should not contain
the roles, only the detailed response when you get a trust
explicitly by ID.  So remove the roles and modify the tests
appropriately.

Note it was also observed that expires_at is present in all
GET resonses, but not in the docs, but this has been agreed
as a docs error so will be addressed via a docs patch.

Change-Id: I5387021a53f3284add9e5e71e9e005c4dd31b76c
Closes-Bug: #1245590
replace "global" roles var names with "all" roles

I found this really confusing during in a code review.

Change-Id: I48695450a3271b561838853638024c5c8c00a4f3
Replace xrange in for loop with range

xrange is not supported in python 3, so replace it with six.moves.range

Closes-Bug: #1259978

Change-Id: I321380693d45f7d48f52da2d0f8e4c137763ab0c
Switch to oslo-incubator mask_password

oslo-incubator has a mask_password now, so use that rather than
keystone's.

Change-Id: I3d89fb844086b85598ad3fd7ae0daa7599a26a30
Merge "Remove roles from OS-TRUST list responses"
Use oslo.db sessions

Keystone was using its own keystone.common.sql module for
database access. oslo-incubator's db.sqlalchemy module provides
the same or better functionality, so use that instead.

DocImpact
- The options that were in the [sql] section are deprecated and
  replaced by options in the [database] section. There are
  also several new options in this section. If database
  configuration is described for another project that uses
  oslo-incubator's db.sqlalchemy module the docs can be shared.

Part of bp use-common-oslo-db-code

Change-Id: I25b717d9616e9d31316441ae3671d2f86229c2bf
Merge "replace "global" roles var names with "all" roles"
Merge "Use oslo.db sessions"
Merge "Switch to oslo-incubator mask_password"
Merge "Replace xrange in for loop with range"