feat(builder): expose runtime configuration during slugbuilder execution

This uses a new Config API Hook to grab the latest app configuration
and expose it to slugbuilder using `-e` flags.

While this works, it is a very good mechanism for handling user-defined
inputs on the builder.  In other words, command-injection is possible
through malformed inputs.  We must consider this as we move to refactor
the builder in Go.
fix(app): only set initial structure when build hook is triggered

As part of the effort to move code from views into models,
we would always scale an app to an initial structure on every deploy.
This made it impossible to, for example, set a BUILDPACK_URL without
triggering a false deploy and timeout.

Moving the logic back into the BuildView where it belongs.
fix(flake8): fix spaces and a docstring
fix(builder): add scale() back to first build
Merge pull request #960 from deis/config-during-build

Expose runtime configuration during slugbuilder execution