Introduce a way to trace a resource's implementation

We need a way to know whether a resource is really the
same during update. This is driven by TemplateResource
but not totally specific to it.

The problem is:
if you update a template with no changes (except for environment
or files changes) we need to know which resources to update.

This patch adds a "implementation_signature()" method that gives
us a mechanism to keep track of implementation changes like:
- a change in an environment mapping a resource to a new/different implementation
- a change in the content of a TemplateResource

And can distinguish between schema changes (requiring replacement) and
incremental changes (that can be updated in place).

Change-Id: I780074a827e3f51dede47a81f15e29dbe4d08804
Closes-bug: #1254966
Service authorize stack user from provided stack

Currently _authorize_stack_user requires that an EC2
keypair comes from an AccessKey resource (or some other resource
which uses the access_key as its resource_id).

This change avoids the separate db resource lookup, and checks
the provided stack for a resource which has an associated access_key.

This could be an AccessKey resource, or any resource which has
registered an access allowed handler via register_access_allowed_handler.

Additionally, the credential_id does not have to be the AccessKey of a
keypair. credential_id could be any value meaningful to the resource
which registers the handler.

Since resources are lazy loaded, register_access_allowed_handler will not
be called until resources are loaded. This loading is triggered in
access_allowed by accessing the resources property.

One of the objectives of hot-software-config is to reduce the
amount of template scaffolding required to enable software configuration.
This change means that an OS::Nova::Server resource wouldn't need
an associated OS::Heat::AccessPolicy, AWS::IAM::User, AWS::IAM::AccessKey
just so that os-collect-config can poll for metadata changes (note that
the actual change that does this for OS::Nova::Server is pending).

partial blueprint: hot-software-config
Change-Id: I52a12ad3cd750ed724893abcd6dc1084b925c089
Merge "Service authorize stack user from provided stack"
Merge "Introduce a way to trace a resource's implementation"