mon: audit cap checks

We don't properly validate caps for some monitor-specific messages, meaning
that we would allow handle some messages that only a monitor should send
regardless of the sender.  A client that would be able to authenticate with the
cluster would then be able to send, say, a MMonJoin message, and the monitors
would take it as is.  Crafting specific messages, a malicious user could take
advantage of this oversight to, for instance, break quorum.

We also add a test that will attempt to send malicious messages;  we don't cover
all the monitor messages but a few that should act as an indicator in case of
regressions.

This branch also contains 3 patches that can be found on a different pull
request (https://github.com/ceph/ceph/pull/2559).

The branch still needs to undergo a few monthrash suites.