Add support for policy configration directories

This patch add new option 'policy_dirs' and restructure
Enforcer.load_rules to loads policy files from directories that
specified by 'policy_dirs'.

Implement bp policy-configuration-directories

Change-Id: I5218c6fa5f678e1c49b055b7ea351d202ea33e0b
Mask passwords in exceptions and error messages

When a ProcessExecutionError is thrown by processutils.ssh_execute(),
the exception may contain information such as password. Upstream
applications that just log the message (as several appear to do) could
inadvertently expose these passwords to a user with read access to the
log files. It is therefore considered prudent to invoke
strutils.mask_password() on the command, stdout and stderr in the
exception. A test case has been added to ensure that all three are
properly masked.

An earlier commit (I173dfb865e84eb7dee54a22c76db1e4f125a0a8a) failed
to address ssh_execute(). This change set addresses ssh_execute.

Submitted to oslo.concurrency in
I0db9e98cbeb2a5e6f9ae0074f24717aa91cfc238

OSSA is aware of this change request.

Change-Id: Ie0caf32469126dd9feb44867adf27acb6e383958
Closes-Bug: #1343604
Merge "Add support for policy configration directories"
Merge "Mask passwords in exceptions and error messages"