Bad except clauses order causes wrong text in http response

InstanceInvalidState is an ancestor class of InstanceIsLocked, so
we need to catch InstanceIsLocked first. Fix the test case to
ensure we get the right http response back

Change-Id: Id22b284d9b7da8db4161ad8703bea1702cb0b82e
Sync the DB2 communication error code change from olso

Closes-Bug: #1244092

oslo patch set: 3acd57c2825a8bf6660c3124f12794414622eb26

Change-Id: I62e3a6d1137d53c4aa72b18db5bd9f7e41694436
Make check more pythonic

Use 'if key in ('metadata', 'system_metadata'):'
instead of 'if key == 'metadata' or key == 'system_metadata''

The reason for the change is:
1. The issue has come up more than once in review cycles
2. It is easier to read

Moving forwards it may be useful if there are extra use cases.

Change-Id: Icd4ab4ebd021720b140f9fdb89d201781388c8ff
Merge "Make check more pythonic"
Merge "Bad except clauses order causes wrong text in http response"
Merge "Sync the DB2 communication error code change from olso"
Enforce permissions in snapshots temporary dir

Live snapshots creates a temporary directory where libvirt driver
creates a new image from the instance's disk using blockRebase.
Currently this directory is created with 777 permissions making this
directory accessible by all the users in the system.

This patch introduces a new decorator that will change temporary the
file-creation mask during for a method. With it we prevent the images
created in the temporary directory from being world readable without
having to worry about race conditions. We also change the temporary
directory permissions so they have the o+x flag set, which is what
libvirt needs to be able to write in it.

Closes-Bug: #1218372
Change-Id: I767ff5247b4452821727e92b668276004fc0f84d
Ensure that libvirt files are not world readable

The files that nova shares with libvirt and QEMU may contain user
sensitive information and it might be a problem if those files are
visible for all the users in the machine. These files include the images
under instances_dir, the base images and snapshots.

This patch uses the decorator introduced in the previous patch, which
will change the user file-creation mask temporarily, during the call of
a method, allowing us to mark methods that shouldn't create world
readable files and thus, protecting them.

Also in this patch, all the calls that interact with libvirt owned files
have been modified to use rootwrap so they can still access these files
(for resizing or creating an image or when migrating an instance).

As a side effect, by setting the proper permissions to libvirt files and
accessing them using rootwrap, this patch avoids problems with cached file
attributes that might trigger problems as the one described in bug 1218372

Closes-Bug: #1129748
Closes-Bug: #1227027
Change-Id: Ib290f8df20a9e29ed98faec221f607b685e26da4