Fix up protocol case handling for security groups.

Fix bug 985184.

When creating security group rules, any case for the protocol was
accepted as input, such as TCP, Tcp, tcp, etc., and was stored in the
database as specified.  However, unless specified as all lowercase, the
code to apply the rules would break and result in some rules not being
applied.

(cherry picked from commit ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654)

Also includes backport of thix fix:
    https://review.openstack.org/#/c/8392

Change-Id: I36af1db29c2bd97627d614df21b5da07db29a8ab
Prevent key/net/md injection writing to host fs

Fix bug 1015531, CVE-2012-3361

Checks that the final normalized path that is about to be written
to is always within the mounted guest filesystem.

This is a Diablo backport of the part of Russell Bryant, Pádraig Brady
and Mark McLoughlin's Folsom patch that applies to stable/diablo.

Change-Id: I134c40258ff2c9c225bd6092decd9c10e4e22273
Backported tox.ini for jenkins.

jtra: Fixed so that tests will pass
jeblair: minor change to test_instance_types.py
  to avoid munging nose internals (which collides
  with nose xunit).

Change-Id: Iec5cb6aa97165289dbb5b73eab0f61fed2d15d0e
Prohibit file injection writing to host filesystem

This is a refinement of the previous fix in commit 2427d4a9,
which does the file name canonicalization as the root user.
This is required so that guest images could not for example,
protect malicious symlinks in a directory only readable by root.

Note this requires adding the 'readlink' binary to the
nova sudoers file.

Fixes bug: 1031311, CVE-2012-3447
Change-Id: I7f7cdeeffadebae7451e1e13f73f1313a7df9c5c
Merge "Prevent key/net/md injection writing to host fs" into stable/diablo
Merge "Prohibit file injection writing to host filesystem" into stable/diablo
Correct checking existence of security group rule

Fixes bug #900031

Change-Id: I4194610ce53d1c74bd99b6878339da6e0b6a3a73
Merge "Fix up protocol case handling for security groups." into stable/diablo
Merge "Correct checking existence of security group rule" into stable/diablo