Fixed CLOUDSTACK-6509 Cannot import multiple LDAP/AD users into a cloudstack account

Conflicts:
	api/src/com/cloud/user/AccountService.java
	plugins/user-authenticators/ldap/src/org/apache/cloudstack/api/command/LdapCreateAccountCmd.java
	plugins/user-authenticators/ldap/src/org/apache/cloudstack/api/command/LdapImportUsersCmd.java

Signed-off-by: Koushik Das <koushik@apache.org>
Removed Epoch tag/number from the cloud.spec to fix the rpm installation of Management Server, Agent and awsapi
disable XS event
CLOUDSTACK-6533: IAM - Templates - Public templates do not have
permissions to be used by ROOT group.
CLOUDSTACK-6532:Affinity Groups - As admin user, not able to list all
affinity groups available for regular users by passing account and
domainId paramater. This is to revert IAM way of implementing
listAffinityGroupsCmd, will bring it back when we have implemented real
impersonation.
CLOUDSTACK-6513: Optimize code by removing deprecated utility to
QueryManagerImpl as private method just used for listTemplates and
listAffinityGroups to avoid misuse by new list APIs.
CLOUDSTACK-6513: templateFilter=shared should not show self-owned
template.
CLOUDSTACK-6231: network acl item cidrs loaded from a seperate table
CLOUDSTACK-6513: remove commented code.
CLOUDSTACK-6502:Remove trailing whitespaces.
CLOUDSTACK-6517: IAM - Admin is allowed to create PortFowarding rule for a regular user, when admin does not have " UseEntry" permission for IpAddress.

Changes:
- IAM was applying ordering on accessTypes. Thus if an account had Operate, he got USe access as well. So even if IAM schema did not have 'UseEntry" permission for IpAddress, some other 'OperateEntry' permission on IpAddress was letting this operation go through.
- Fixed IAM to NOT do ordering of access types anymore. IAm will perform strict accessType check only.
- This fix is needed so that admin does not get permission to USE resources from other account just becase he has OPERATE access on those resources due to some other APIs.

- However due to this fix, we break backwards compatibilty with CS 4.3.
- CS 4.3 allowed root admin to do the createPF operation for a user by passing in networkId of the user.
- Same was the case for domain admins within their domains
- Why this worked was due to CS 4.3 simply returning true for root admin/domain admin

- So to maintain backwards compatibilty, we are adding the logic to return "true" for root admin and domain admin just like CS 4.3.
- Exception is: For Network, AffinityGroup and Templates, we still call IAM even for root admin/domain admin, since thats what CS 4.3 did. Just for these 3 resource_types, it used to perform access checks even for root admin/domain admin.
CLOUDSTACK-6549: ommission due to insufficient tests in CLOUDSTACK-6231
CLOUDSTACK-6443: [Automation] Two Test Cases failed on "test_volumes.py"
- AttributeError: VirtualMachine instance has no attribute 'hostid'.
CLOUDSTACK-6556: [Automation] Deploy VM failing with error "does not
have permission to access resource Ntwk".
CLOUDSTACK-4549: Do not force RBD snapshot backups to RAW format

Since we use qemu-img to copy from RBD to Secondary Storage we no
longer have to force to RAW images, but can stick with QCOW2

When the snapshot backups are QCOW2 format they can easily be deployed
again when restoring from a backup

Conflicts:

	plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
CLOUDSTACK-6535: IAM:MS:API createVMSnapshot doesn't preserve access
rights.
CLOUDSTACK-6556: Deploy VM failing with error "does
not have permission to access resource Ntwk".
CLOUDSTACK-6438: WIP: If VM has additional IPs, keep showing in add screen
CLOUDSTACK-6438: WIP: Add filtering to check against existing IPs
CLOUDSTACK-6438: Filter out existing IPs in dropdown