Work around heat-cfntools/boto/keystone issue.

Heat-cfntools uses boto to communicate with Heat's Metadata server. In
more recent versions of boto, there is no option to use older AWS
signature methods. Only version 4 is supported. However, keystoneclient,
which keystone uses for validating signatures, only supports this in
trunk. Until that is released, any boto version after 2.5.2 will cause
heat-cfntools to be unable to authenticate with Heat.

By installing heat-cfntools in a virtualenv, we isolate it from the rest
of the system. This way as the boto version advances, we stay with the
one that works with heat-cfntools according to its own requirements.

Fixes bug #1183732

Change-Id: If0d83a29e8a7df59c1dc08f4ceae8fec2882725d