Ban database access in nova-compute

This adds a wedge between nova-compute and the database implementation
to specifically catch, log, and deny accesses. Theoretically, this
should not be needed as a production environment would not even have
the compute nodes configured to talk to the database. However, testing
and upgraded environments may retain database access and thus avoid
hitting real issues that can be fixed up prior to release. Putting
this into the tree now will help ensure we have a consistent error
scenario for test setups prior to release.

Note that if nova is configured to use a local conductor, we do not
insert the wedge, which provides an easy out for anyone needing to
get a production system past a missed database access.

Related to bp no-db-compute.

Based on Russell's original tracer hack:

   I328fa92d5bfdadd5022f5c7efe981396d8ae7962

Change-Id: I478230220633e0d2ff94b6a4d756e07eab8517d7
Merge "Ban database access in nova-compute"