Set the volume access mode during volume attach

cinderclient supports an optional keyword argument named 'mode'
for volumes.attach(), which allows you to set the access mode of
a volume at attach time. The keyword argument is not passed in
by nova when it attaches a read-only volume, making the volume
access mode default to 'rw' instead of the desired 'ro'. This
patch finds the access mode of the volume and passes it to
cinderclient, so the correct access mode is used at attach
time.

Change-Id: Ib62f454292e60114f96debbad96c4a356dc32a21
Closes-Bug: #1307088
(cherry picked from commit de05c2994212e83eba3cedf2544cdc549d9f8184)
Avoid possible timing attack in metadata api

Introduce a constant time comparison function to
nova utils for comparing authentication tokens.

Change-Id: I7374f2edc6f03c7da59cf73ae91a87147e53d0de
Closes-bug: #1325128
(cherry picked from commit 14e52608a1ff888a211647dfdc7fb41dfa86a187)