Framework for default administrative roles - EUCA-8159

Default roles are now discovered and created on cloud startup. The
tokens service is updated to allow roles to be assumed using the system
account name rather than number so the role ARN is predictable.

EUCA-8159
Default roles for personas - EUCA-8159

Add default administrative roles for account, infrastructure and
resource administrators for personas.

EUCA-8159
Internal service authorization updated to support personas - EUCA-8157

Properties, configuration and empyrean services now have a vendor for
use in IAM policies. Internal service authorization checks now include a
policy check. PolicySpec is updated to include eucalyptus specific EC2
actions. VmTypesManager is updated to allow delegation of the modify VM
types action.

EUCA-8157
Merge remote-tracking branch 'origin/dev/sjones/EUCA-8157' into dev/sjones/personas-infra-defaults
Merge remote-tracking branch 'origin/dev/sjones/EUCA-8159' into dev/sjones/personas-infra-defaults