Change EC2 client tokens to use system_metadata

An EC2 client token is created as a result of RunInstances. The initial
implementation called create_tags which uses per-instance metadata.
However, we can't update per-instance metadata while an instance is still
building because put the metadata updates in the messaging queue.

We avoid this problem by using system_metadata instead of per-instance
metadata. As an added bonus, users can't tamper with the token via the tags
API.

Fixes bug #1202404

Change-Id: I8ff28d75154a30fe3b521926453b9e9cbdd9fead