Implement name space for domains

Creates a separate name space for each domain for the name attribute of
user, groups and projects - meaning that the names of these entities
only have to be unique within that domain.

Implementation of this within the SQL backends is handled by simply
changing the uniqueness constraints on the relevant attributes.  KVS
and LDAP backends do not yet support domain separation (blocked by
existing restrictions, already raised as bugs).

An issue exists for the downward migration with this change in that
if the database has been used and populated with the name space in place
then the downward migration may fail due to clashing names when you
try and revert to a global name space (raised as a separate bug)

This patch also improves the group support in the KVS backend and
cleans up string quoting in the 016 migration fucntions, and fixes an
issue where the SQL update_project was not updating a change in domain_id.

Change-Id: I8f0df0e1bf84bfd26b8ef5505fe5fafd930dc78b
Update the Keystone policy engine to the latest openstack common

Fixes Bug #1126037

Change-Id: I246bc9c0c2eb0f4af97c11588c80e4bcea06e747
Ensure user and tenant enabled in EC2

Fixes bug 1121494.

Change-Id: If7277f0b4a55aa5be81b354cd4c7ed338a600a62
Merge "Implement name space for domains"
Merge "Update the Keystone policy engine to the latest openstack common"
Merge "Ensure user and tenant enabled in EC2"