select a more proper pool during testing.

We were getting random 403 errors from spec tests on the jenkins
build box. Debugging revealed rules violations because we randomly
pulled the first one which isn't always a valid one. Since we setup
the subscriptions in candlepin_scenarios, product2 is a more proper
target for binding. So we now look for the subscription that maps
to that product and its pools/entitlements to consume.
Allow User objects to carry non-persisted permissions.

Previously these were tied to Roles, which are a DB construct. User
services however return User objects, and would have to fake Roles with
PermissionBlueprints just to end up with Permissions on a Principal.

Instead allow UserServiceAdapter implementations to stamp permissions
directly onto a User when returning it, which will be transferred
straight to the Principal once created.

If roles are present, it will create and return Permission objects for
these as well.
Merge remote-tracking branch 'origin/master' into dgoodwin/user-perms
Fix oracle/mysql schema problems.
Fix positional enum permission access.

Enum was being stored as a positional integer, so changing the order or
adding new entries to the enum could potentially throw off what was
stored in the database and grant more access than intended.

Switch to using strings for the enum as we do most other places.