Drop Barbican from the tree

We're not ready to support barbican yet, so it's just dead code.
Removing it until we're ready, at which time we can use git history to
find these things.
upload our test image as public

A public image allows non-admin tenants to make use of the image for
testing, like with rally. The upstream version of glance_image for a
while has supported making the image public. We don't use the locally
added cacert option any more so we don't need to carry our own
glance_image.
Merge pull request #644 from blueboxgroup/no-barbican

Drop Barbican from the tree
Merge pull request #641 from blueboxgroup/public-cirros

upload our test image as public
Add an upgrade playbook for upgrading to juno

Upgrade from havana to juno, following
http://docs.openstack.org/openstack-ops/content/upgrades_havana-icehouse-ubuntu.html
mostly.

Our databases are already UTF-8 so that step is skipped.

Roles are applied to get new software in place, without a restart of the
services, and then services are managed in order to do database
migrations.  Some attempt is made to minimize the complete downtime of
any one service.

A new stop-services role is introduced in order to be able to interleave
it with the other roles.
Add test/run ability to run upgrade.yml
Update python-novaclient and python-neutronclient to meet neutron icehouse requirements
update glance, horizon, keystone, neutron and nova to stable/icehouse
Hide external networks from launch instance workflow
Hide Neutron LBaaS in Horizon
Upgrade Neutron to icehouse
neutron nova notifications
Neutron: nova notification config
Run update-ca-certificates during SSL task in common
Update keystone to juno

Adds public_workers and admin_workers options

Refresh keystone-paste.ini and policy.json from upstream
Enable forced database migrations

Existing check will just read back what's in the database as reported by
the manage utility, which just reads the database, so I'm a bit confused
as to what it was trying to accomplish. Either way this change
introduces a way to force a migration.
Update glance to Juno

Some conf entries are deprecated in favor of new ones.

sync paste and policy from upstream.
  Disable osprofiler by default.
Upgrade cinder to juno

Had to add a whole new keystoneauth section for new options.

api-paste updates
  sync with upstream
  clean up keystone middleware for correct options

refresh policy.json from upstream
Upgrade nova to juno

Required a glance and neutron section for associated configs.
Required a keystone_authtoken for renamed settings.
Removed image_service, has been gone since 2012
Update api-paste to match upstream
  v3 and v21 paths.
  request ID logging
  Updated keystone authtoken argument for identity_uri
  (http://www.jamielennox.net/blog/2014/05/21/identity-uri-in-auth-token-middleware/)
Neutron juno upgrade

Updated keystone options.

update api-paste from upstream
  Also use keystone middleware identity_uri

refresh policy from upstream

Update nova notification details with the right tenant

Add support for migrating neutron database

Add ipset utility on neutron data nodes, as the agent uses it now.