build auth context from middleware

Refactors the logic where we build the credentials (or auth context), to be
used for authorization decision, from the incoming auth token to be handled by
middleware. The authorization code is isolated into
keystone.common.authorization.

This patch lays the plumbing for bp client-ssl-certificate-authorization.

DocImpact: added a new build_auth_context middleware filter to the API
pipelines in keystone-paste.ini. It is responsible for building the auth
context (a.k.a. policy-check credentials) based on the incoming auth token
to facilitate API authorization. Auth context is required for API
authorization.

Change-Id: Icee58a5bd47b0ded3b53a8838012864c1c0abcc5
Merge "build auth context from middleware"