Enforce 'download_image' policy in cache

Ensure that cached images do not bypass the
'download_image' policy.

Backport of https://review.openstack.org/#/c/50016.

Fixes bug 1235378.

Change-Id: I2082445ecb4703e642e9ff518b275846e7a8d573
Merge "Enforce 'download_image' policy in cache" into stable/grizzly