[RFC:dont-merge-yet] certlib and friends refactor and cleanup, identity injection, etc Alikins/certlib cleanup rebase

I apologize for the sloppy commit history... Hopefully I can clean it up a bit more.

This started as the first pass at flex branding, and kind of diverged. Initially, the plan was to clean up the many places where ent certs get installed. I haven't quite gotten that far yet.

But, this fixes alot of inconsistencies in certlib/factlib/etc. It splits out entcert, identitycertlib, and others out from the certlib module. Part of that includes making sure they all follow the pattern of:

somethinglib.py
    SomethingLib
         has a SomethingLibUpdateAction

   SomethingLibUpdateAction
      has an ActionLocker
      has an ActionReport

It changes the certmgr module and classes to be a little less hardcoded, and hopefully better at handling errors. Each *Lib[1] module has an ActionReport now, that can return more detailed info than the "update count" it previously did. 

For testing, this also moves to using injected identity everywhere. The SubManFixture knows how to inject mock identity, ent dir, etc. This also add facts, profile manager, installed package profile manager, and an "action lock" to the things inject. 

An ACTION_LOCK is just the mechanism uses to implement the Locks, as used by *LIb/*LibUpdateAction, etc. For unittests, this is just a threading.RLock (as opposed to the file lock used normally).