Modify stack_user_domain config option to take domain ID

It turns out that having the heat service user manipulate (get/create)
domains directly isn't a great idea, because although it works with
the default keystone policy.json, it won't work with the v3cloudsample
policy, which causes some of our tests to fail in the gate when migrating
the User/Access key resources.  Also not allowing the heat user to
create domains is probably more aligned with real deployment policy
expectations.

Note this requires the following devstack change, which will create the
required domain and update heat.conf appropriately:

https://review.openstack.org/#/c/73324/

Or for non-devstack deployments, the domain should be created via
python-openstackclient (which is the only CLI interface to the v3
keystone API, the keystoneclient shell is v2.0 only), e.g:

openstack --os-token <atoken> --os-url=http://<KS_IP>:5000/v3 \
    --os-identity-api-version=3 domain create heat

Change-Id: I2b058fd1b6361b04764111635f7ef7424cb73d7b
blueprint: instance-users
Move HOT version checking to HOTemplate class

This is HOT-specific code and does not belong in the Template class.

Change-Id: I95c5f1d57a8ad4f9f4b721742f2d45826b51e9aa
Merge "Modify stack_user_domain config option to take domain ID"
Merge "Move HOT version checking to HOTemplate class"