heat_keystoneclient: Fix consuming trusts via v2 API

Contrary to my understanding when I first wrote this code, it is
possible to consume trusts (ie get a trust scoped token) via the
v2 keystone API.  So this patch reworks the heat_keystoneclient
so we:
- Consume trusts via the v2 client (so we can access the ec2tokens
  extension which is v2-only)
- Only create a v3 client when required (when creating or deleting
  a trust), so we minimise the requests to keystone.
- Similarly it's only necessary to create the v2 client when creating
  the client object if we need to consume a trust
- When a trust is found in the context, we always consume it
- Don't modify the request context, as this has undesired side-effects
  if the context is subsequently used to perform actions which require
  obtaining a keystone token, instead create a context containing a
  trust_id and trustor_user_id when the stack is stored.

Note this change depends on this patch to python-keystoneclient:
https://review.openstack.org/#/c/48462/, so consuming trusts won't
work unless a version of keystoneclient including this change is
used.

Change-Id: I61b380bc63d606c128ce029f1960c6812a3324e3
Closes-Bug: #1227901
Merge "heat_keystoneclient: Fix consuming trusts via v2 API"