Add an upgrade playbook for upgrading to juno

Upgrade from havana to juno, following
http://docs.openstack.org/openstack-ops/content/upgrades_havana-icehouse-ubuntu.html
mostly.

Our databases are already UTF-8 so that step is skipped.

Roles are applied to get new software in place, without a restart of the
services, and then services are managed in order to do database
migrations.  Some attempt is made to minimize the complete downtime of
any one service.

A new stop-services role is introduced in order to be able to interleave
it with the other roles.
Add test/run ability to run upgrade.yml
Update python-novaclient and python-neutronclient to meet neutron icehouse requirements
update glance, horizon, keystone, neutron and nova to stable/icehouse
Hide external networks from launch instance workflow
Hide Neutron LBaaS in Horizon
Upgrade Neutron to icehouse
neutron nova notifications
Neutron: nova notification config
Run update-ca-certificates during SSL task in common
Update keystone to juno

Adds public_workers and admin_workers options

Refresh keystone-paste.ini and policy.json from upstream
Enable forced database migrations

Existing check will just read back what's in the database as reported by
the manage utility, which just reads the database, so I'm a bit confused
as to what it was trying to accomplish. Either way this change
introduces a way to force a migration.
Update glance to Juno

Some conf entries are deprecated in favor of new ones.

sync paste and policy from upstream.
  Disable osprofiler by default.
Upgrade cinder to juno

Had to add a whole new keystoneauth section for new options.

api-paste updates
  sync with upstream
  clean up keystone middleware for correct options

refresh policy.json from upstream
Upgrade nova to juno

Required a glance and neutron section for associated configs.
Required a keystone_authtoken for renamed settings.
Removed image_service, has been gone since 2012
Update api-paste to match upstream
  v3 and v21 paths.
  request ID logging
  Updated keystone authtoken argument for identity_uri
  (http://www.jamielennox.net/blog/2014/05/21/identity-uri-in-auth-token-middleware/)
Neutron juno upgrade

Updated keystone options.

update api-paste from upstream
  Also use keystone middleware identity_uri

refresh policy from upstream

Update nova notification details with the right tenant

Add support for migrating neutron database

Add ipset utility on neutron data nodes, as the agent uses it now.
Upgrade percona to 5.6

A neutron migration will crash 5.5
sst method upgraded to v2. Previous version does not work.
Update heat to juno

Minor config adjustments refreshing against juno upstream
Update swift to juno

Adjust config files with upstream examples from juno.
Update client software to latest master

Everything should be updated right?
Replace NOVA_VERSION with OS_COMPUTE_API_VERSION as per upstream
changes.