Make subscribe_sqs_queue idempotent

This patch changes the sid from being a random UUID4 string to an md5
hash of the combined topic & queue ARN.  Since the Sid is now a known
value we can check to see if a Statement with the given Sid already
exists.  If it does, do not add it again.

The reason for this is that as subscribe_sqs_queue is it isn't
idempotent.  It will add the same statement (with a new Sid) repeatedly
until you hit the limits of the SQS Policy (20 statements, 8192 bytes).
Clean up some unnessary if statements
Initial integration tests for idempotent subscribe

For https://github.com/boto/boto/pull/1414

There is occasionally a failure on the first assert in
'test_idempotent_subscribe' where Amazon hasn't yet propogated the
policy change when we do the get_attributes after the first subscribe,
so it still has 0 statements in it.  I'm not sure what the best way to
deal with this is.
Added sleeps to allow amazon time to propogate

The policy statements would some times not be propogated by the time we
went looking for them.  While I hate inserting time into the tests, this
seems to be the safest way.  I believe 3 seconds should be enough (1 was
enough in all my tests).
Add metadata_service_num_attempts config option

When retrieving credentials from the metadata service,
it is possible to set a config option to specify the number
of seconds before timing out the request, but no option
exists that specifies the number of attempts to make to
the metadata service.

I also made two changes to the metadata retrieval process:

* If we're on the last iteration of our retry loop we
don't sleep.  This allows us to maintain our 1 second max delay
by default if no metadata credentials are available.

* Remove urllib2 error catching. This is raised when a timeout
occurs and this is something we definitely want to retry.

Added a unittest for the config option and also verified
on an EC2 instance with an IAM role specified that the failure
conditions are retried appropriately when
metadata_service_num_attempts is set.
Merge branch 'metadata-num-retries' into develop

Closes #1436.

* metadata-num-retries:
  Add metadata_service_num_attempts config option
Fixed missing import.
Merge remote-tracking branch 'phobologic/sns_subscribe_idempotent' into develop
Fix #1146: return response from custom url opener

The previous fix for this (70e9ec) created a proxy opener
and retrieved metadata results, but then called urlopen(...)
and returned those results.  The end result was that you
were getting the proxied result, which is not what we want.

As a side effect of this bug, we were making twice as many
calls to the metadata service than we needed, once using
the custom opener we create, and once using urllib2.urlopen.

I've also added a unit test for this fix.  It's admittedly a bit
contrived, but it did fail before implementing the fix, and it
does pass now with the fix in place.
Only use 2 metadata service calls to get credentials

Because of the lazy loading dict returned when retrieving
IAM role credentials, we were making twice as many calls:

* .../meta-data/
* .../meta-data/iam/
* .../meta-data/iam/security-credentials/
* .../meta-data/iam/security-credentials/role-name

Instead the ``data`` arg is used so that we can make only two
calls, one to retrieve the role name, and one to retrieve the
actual credentials:

* .../meta-data/iam/security-credentials/
* .../meta-data/iam/security-credentials/role-name
Merge branch 'iam-metadata-num-calls' into develop

Closes #1439

* iam-metadata-num-calls:
  Only use 2 metadata service calls to get credentials
  Fix #1146: return response from custom url opener