EC2/IAM support for PassRole action - EUCA-6432

Support is added for the iam:PassRole action used when running
instances.

The metadata_vm_nameorarn column is moved from VmId to VmBootRecord and
the profile identifier and role ARN are now also persisted. This avoid
lookup on instance listing and ensures that the role cannot be modified
after an instance is launched. For instance run after 3.4 is installed
the metadata_vm_nameorarn column will always be an ARN and not a name.

Allocations is updated with bookeeping for the new/moved properties.

VerifyMetadata has a new RoleVerifier which is reponsible for ensuring
permissions to use an instance profile / role.

VmInstance is updated to use the VmBootRecord information when
transforming for describe and when metadata is accessed.

On upgrade only the metadata_vm_nameorarn column will be populated, for
instances created in 3.4 onwards all or none of the VmBootRecord fields
will be populated when using an instance profile.

EUCA-6432
Merge remote-tracking branch 'origin/dev/sjones/EUCA-6432' into testing