Add support for conditions in IAM policies
Move user-data handling into its own plugin

This leaves as the sole concern for instance launch maintaining the
interface to the underlying AWS APIs.

The handling that was being performed is very much tied to Ubuntu's
CloudInit project and should be maintained separately. This should also
make it easier to add the missing gzipping of multipart mime-encoded
user-data sections, which will be needed sooner or later.
Ignore null/empty entries