Configurable token hash algorithm

Tokens were always hashed with MD5. This change allows tokens to
be hashed with SHA256 (or any other algorithm supported by the
keystoneclient token hash function). This is for security
hardening.

There's a new configuration option 'hash_algorithm' in the [token]
section. This is the algorithm to use for hashing PKI tokens, so is
used

a) when storing the token in the db
b) as the hash in the revocation list

hash_algorithm defaults to 'md5' for backwards compatibility.

SecurityImpact
DocImpact
Closes-Bug: #1174499

Change-Id: Iafe3c975d59818c8f362647f7ea5149a03deee47
Include extra attributes in list results

The extra attributes defined in the *_additional_attribute_mapping config
options weren't included in the list results. These attributes should be
included in the list results.

Change-Id: Ia80174063a5eacdef690ca378b7cb71300a5f5f8
Closes-Bug: #1293698
Code which gets elements of tree in ldap moved to a common method

Code which uses 'search_s' in ldap backends moved
to a new method to remove duplication of code.

Change-Id: I5b9b89d452d6031b54ccb15cdbd9129939d29f7f
Discourage use of pki_setup

After a mailing list discussion it is clear that users need more
information to make a decision on how to setup their PKI tokens.

This recommends an external CA over using keystone pki_setup as it does
offer a bit more protection against an intruder being able to setup a
rogue token generator.

Change-Id: I798a562dd8c222e04660482b434ed3bbe6b63d62
Merge "Discourage use of pki_setup"
Merge "Code which gets elements of tree in ldap moved to a common method"
Merge "Configurable token hash algorithm"
Merge "Include extra attributes in list results"