Throw 404 for non-existent org for bulk_process

Fixes #1682
[#1817] Upgrade SQLAlchemy to 0.9.x

No changes needed in the CKAN code base, but it requires changes on vdm,
see this branch:

https://github.com/okfn/vdm/tree/sqlalchemy-0.9-support

Also upgraded sqlalchemy-migrate.
Extend IDomainObjectModification

Currently the notify signal is sent before the database commit has occurred. It
is not possible to listen for modification events and know that the changes
have made it to the database. This can lead to a race condition if you try to
get a record from the database.

For an example see:

https://github.com/ckan/ckanext-archiver/issues/6

This extension of the interface would allow notification after the database
commit has occurred.
Merge branch 'master' into 1682-bulk-process
[#1682] Test that 404 is returned
[#1682] Fix pep8 issues
[#1879] Set DataStore to legacy mode when using PostgreSQL < 9.x

Up until now the user had to actively set legacy mode when running PG
8.x, and if not you could end up with the full datastore running on an
old postgres version. Features like the SQL search are not properly
supported on these versions, so we need to explicitly disable them when
running on PG 8.x, by setting `legacy_mode` to True.

The current behaviour is that legacy mode will be activated if
`ckan.datastore.read_url` is not present in the configuration and/or
postgres < 9.x.
[#1879] Fix tests

The travis setup explicitly removes the `ckan.datastore.read_url`
setting when running the tests, so we need to use a dummy one.

Also some refactoring
[#1871] Add function to extract table names from SQL statement

The function performs an EXPLAIN query with the provided statement and
parses its output looking for table names. It requires Postgres >= 9.x,
as it uses the FORMAT JSON option to get and parse a JSON objects.
 [#1871] Disallow DataStore SQL queries involving system tables

 Using the `get_table_names_from_sql` helper function before running the
 provided statement, we raise a Validation error if some of the tables
 start with `pg_`.
[#1871] Fix tests

PEP9 and skip the get table names tests if running on legacy mode.
[#1871] Fix wrong call in tests
[#1817] Update requirements file now that vdm is on pypi
[#1804] Add config tool.
[#1804] Config tool can uncomment commented options.
[#1804] Config tool used by Dockerfile.
[#1908] remove IConverters and make get_converter an alias for get_validator
[#1909] phix phantomjs peerinvalid phailure
[#1902] Don't show private datasets to group members

1. User Sean creates organization my-org
2. Sean adds private dataset my-dataset to my-org
3. Sean creates group my-group
4. Sean adds private dataset my-dataset to my-group
5. Sean adds user Fred to my-group
6. The group_show API will now show the private dataset my-dataset to
   Fred, even though Fred is not a member of my-org.

For some reason the private dataset does not show on the group's page,
but it does show in ther API.

This commit removes it from the API.

If backported this commit will also fix a problem present on 2.2 and
2.2.1 (but not master) that after following the steps above Fred will
see the private dataset on the site front page.

Arguably you should not be able to add private datasets to groups at
all, but you could add a public dataset to a group and then make the
dataset private and it would still belong to the group, so we do need to
filter private datasets out of groups.
[#1902] Test that group_show() doesn't show private datasets