Add policy enforcement to ReST API

Currently the native API lacks support for enforcing policy via
policy.json, as is possible for the aws-compatible APIs.

So modify and rename the tenant_local decorator to also enforce
policy, and add tests to ensure the API controllers are all
using the decorator on their actions

Change-Id: Id80d576d5ff5e546da42dbf08ebd653005af14ff
blueprint: request-scoping-policy
Add filter and pagination to stack_get_all

This change prepares the ground for calls that are not tenant-scoped
to make use of the filter and paging capabilities.

Implements: blueprint management-api
Change-Id: I4862752999629666b46da20c2713edc950c5d52e
Unscoped List Stacks

This allows non tenant-scoped list of stacks for the management api
blueprint.  A user with a cloud_admin role will be able to make a call
to /tenant_id/stacks and get all the stacks, and not just the ones owned
by them, effectively bypassing the tenant scoping.

If the user is not an admin, only their stacks will be returned
(unchanged behavior).

The db_api is now the gate to scope stacks by tenant appropriately.
Users that do not pass the cloud_admin rule as defined by the policy
will have requests to the DB scoped by their tenant_id.

Implements: blueprint management-api
Change-Id: I973a7ad2726eb6d9c972d08abe15e241aa120ec3