Role based IAM

Same as @mwhooker patches (https://github.com/wal-e/wal-e/pull/86) with minor changes.

I broke out some refactorings to make this patch smaller and overhauled the blackbox testing infrastructure to allow and demonstrate parameterized, "multi-backend" (really: multiple credential regimes) testing of the role-based iam functionality.

I also squashed the command line option with the functionality: the combined patch is not too large and nobody is going to want one without the other.