fix(controller): store limit fields on config

Having a separate "Limit" domain object was getting in our way, when
really it represents just an extension of a Config. This moves the
two JSON fields "cpu" and "memory" to Config and does away with Limit.
fix(controller): specify dicts as defaults and guard against old errors

We should have been initializing our JSONFields with dict objects, not
strings. Also upgrading from a slightly earlier version of Deis to this
change could hit a JSON encoding error, so catch that and use the chance
to clean up the data. Also reverted the unnecessary workaround of
subclassing JSONField.
test(docs): add a `make test` target
docs(community): add policy on bounties
Merge pull request #1630 from mboersma/1613-limit-is-config

fix(controller): store limit fields on config
Merge pull request #1650 from gabrtv/bounty-policy

docs(community): add policy on open source bounties
chore(controller): update djangorestframework to 2.3.14

Several months of cleanup and bug fixes to a core Deis library:
https://github.com/tomchristie/django-rest-framework/compare/2.3.13...2.3.14
fix(builder): disallow password authentication

Ref: #1340

Replaces the previous password prompt with an error message similar to:

    kamina ~/tmp/deis/example-go (git:master) ✔
    ❯❯❯ git push deis master
    Permission denied (publickey).
    fatal: Could not read from remote repository.

    Please make sure you have the correct access rights
    and the repository exists.

Ideally we would brand this with a Deis-centric message, but for now
this should be good enough until we overhaul the builder completely.
fix(builder): don't reload cedarish if its already loaded

Ref #1643

Also add log messages
Merge pull request #1645 from deis/builder/dont-reload-cedarish

fix(builder): don't reload cedarish if it's already loaded
Merge pull request #1648 from mboersma/1646-docs-make-test

test(docs): add a `make test` target
Merge pull request #1586 from mboersma/update-django-rest

chore(controller): update djangorestframework to 2.3.14
fix(controller): validate Cluster.hosts field as comma-separated hostnames
Merge pull request #1651 from mboersma/1552-validate-hosts

fix(controller): validate Cluster.hosts field as comma-separated
Merge pull request #1652 from deis/fix/builder/no-password

fix(builder): disallow password authentication
feat(builder): automatically run `git gc` on deploy

Ref #987

This should be replaced by a cronjob after we switch to the new init,
but this will do for now.
fix(controller): validate app structure values

This guards against `deis ps:scale web=-1` and other bad input.
Merge pull request #1654 from deis/feat/builder/auto-run-git-gc

feat(builder): automatically run `git gc` on deploy
feat(slugbuilder): build without using a pipe for git archive

Ref #785
Ref deis/slugbuilder#9

This will break builds if the corresponding slugbuilder patch is not
merged first.
Merge pull request #1658 from mboersma/1557-validate-ps-scale

fix(controller): validate app structure values