Update keystone config to clear warnings

These options were causing deprecation warnings. A couple of these are
now different from the stable/juno defaults, but that's because these
defaults were fixed after the stable branch was created. These changes
should not alter current behavior, other than clearning the deprecation
warnings.

xml_body middleware is deprecated, and removed in kilo
token driver path changed
token_format is now driver under [token]
revoke default driver path changed
Utilize running conductor service

This makes use of the nova conductor, shielding some services from
directly reading/writing to the database, instead passing messages in
rabbit to the conductor service to interact with the database. It also
provides translations for RPC message objects when an object is recieved
by a nova service and that service cannot understand the version of the
object.

Conductor service will enable better orchestrated upgrades of nova to
reduce downtime as much as possible and allows for mixed versions of
services running, and allows for database to be migrated before
upgrading nova-compute.
Merge pull request #690 from blueboxgroup/enable-conductor

Utilize running conductor service
Merge pull request #685 from blueboxgroup/keystone-tokens-sql

Update keystone config to clear warnings
Reduce haproxy refresh handlers to 1

We had handlers for reload and restart, and sometimes both would happen
in quick succession and seemingly cause issues. Reduce them down to just
restart and call it good.
Merge pull request #693 from blueboxgroup/cleanup-haproxy-notices

Reduce haproxy refresh handlers to 1
Reload instead of restart haproxy

Since haproxy needs to be alive for the entirety of a client session,
use the reload functionality. It'll create a new process with new
settings but leave the old process in place until the existing sessions
finish up.
Ensure haproxy service gets enabled

This used to be a side effect of a handler, which is lame. So now it's
an explicit task. We want to flush handlers before the task though to
prevent the task starting the service and then the handler restarting it
immediately after.
Merge pull request #696 from blueboxgroup/reload-not-restart

Reload haproxy instead of restarting it
Enable PKI tokens for keystone

This switches from UUID based tokens to PKI tokens. Tokens get signed by
keystone, services can validate the token without having to communicate
with keystone API. This setup is using self signed keystone generated
certs as the certs are only used within the services.

Introduces a new variable, country_code, used when generating keystone's
signing cert.