Refactor salt::grain & related tool

This patch renames 'grain-merge' to 'grain-ensure' and makes it accept an
action parameter, which may be one of 'add', 'remove', or 'contains'. The
'contains' action is then used to define satisfaction criteria for the exec
resource that sets or removes the grain value.

Change-Id: I5c8c292ad854bd5cfa262ceedab6b87f5ae10efd