move cinder_config and glance_api_config changes from ceph to cinder and glance modules
refactor Ceph init.pp

 * extract ceph.conf handling into ceph::conf
 * rename ceph::deploy to ceph::mds (and leave it disabled)
 * move libnss handling to ceph::libnss class in params.pp
 * move ceph service definition to ceph::params
 * simplify role-dependent declarations and ordering rules
 * include ceph::cinder for cinder nodes, but don't include ceph classes
   by default for unrecognized node roles
 * install python-pushy instead of pushy in Debian-based systems
 * minor formatting fixes to calm down puppet-lint
refactor Ceph mon.pp

 * drop keyring file declarations, check for ceph-create-keys instead of
   running ceph-deploy gatherkeys to check for Ceph cluster quorum
 * move Ceph client ACLs definition to cinder.pp and glance.pp
 * extract c_pools subclass into a proper ceph::osd_pools class
 * parametrize Cinder and Glance pool names explicitly and separately
   instead of accessing them by indices in a list
 * drop the checks for $::glance_api_conf and $::cinder_conf
refactor Ceph osd.pp

 * replace fine-grained require 'ceph-deploy init config' with a
   coarse-graned chaining from ceph::conf to ceph::osd
 * extract $osd_devices check and cross-manifest relations to init.pp
 * add missing include ceph::mon to ceph::controller
refactor Ceph nova_compute.pp

 * declare ceph::nova_compute only for compute role, it's useless in
   ceph::controller
 * drop TODO for moving the RBD secret.xml to mktemp (it's much safer to
   keep it in /root/, and virsh is unable to accept it on stdin so we
   can't get rid of it altogether)
 * move external relationship declarations to init.pp
 * keep conditionally redefining nova-compute service if nova::compute
   isn't defined, but define its subcribe relationship unconditionally
   so that the class fails instead of doing nothing when nova is absent