Add tracking of instance ghosts

With some virt drivers, deletion of an instance does not immediately
release the resources formerly used by that instance; the virt layer
instead must perform some scrubbing for security purposes, which
may take some time.  This change adds the concept of a "ghost" to
nova-compute: a "ghost" is an object which holds the resources
formerly held by the deleted instance until a given expiration time.
A ghost may be returned by the virt driver's destroy() method, in
place of the default None return value.

Ghosts are not persisted to the database; they represent a best-
effort mechanism to prevent scheduling an instance to a host which
may not yet have made the vacated resources available.  Should a
ghost be lost, and a compute node fail to create an instance as a
consequence, the normal rescheduling mechanism should suffice to
ensure the instance is created.

Partially implements blueprint ghosts.

Change-Id: I1f9d8e1bfa47a4aab99cfe76567779e841c37a8f
[xenapi] Create a ghost when deleting an instance

The XenAPI has to scrub the memory used by an instance after deleting
it.  This imposes a delay--variable on the size of the instance and
the speed of the hypervisor host--before that memory can be reused.
To account for the memory being unavailable, this change causes the
virt driver to return a Ghost when an instance is destroyed.  The
expiration time is computed using a simple linear equation, with the
size of the instance memory, in megabytes, being the variable.  The
constants of this equation are set through the configuration options
xenapi_ghost_constant and xenapi_ghost_multiplier, and the expiration
time for the ghost is computed as:

    expire = xenapi_ghost_constant + memory_mb * xenapi_ghost_multiplier

where "memory_mb" is the size of the instance's memory allocation in
megabytes.  The defaults for the configuration options are chosen to
compute one second per gigabyte plus a constant half-second overhead.
As the ghost mechanism is a best-effort mechanism, these defaults
should be sufficient, but they are made configurable for tuning.

DocImpact

Implements blueprint ghosts.

TODO:

* Add tests to confirm that a ghost is returned.
  - Semi-blocked on I6f36cea7d926c5773cfee1c5868c72acf56f3220

Change-Id: I82f5d68f34677869cb76fbf08445acbb6f37e592