Change EC2 client tokens to use system_metadata, not instance metadata

An EC2 client token is created as a result of RunInstances. The initial
implementation called create_tags which uses per-instance metadata.
However, we can't update per-instance metadata while an instance is still
building because put the metadata updates in the messaging queue.

We avoid this problem by using system_metadata. As an added bonus,
users can't tamper with the token via the tags API.

Fixes bug #1202404

Change-Id: Ia904e75bce152fb1ee9c3929f7a0e2289781dfbb