Update db password migration script to remove node attributes

On update, we want to use the db password from the proposal / role, and
not the one that might have been generated on the node (through the
cookbook). As the password is a "normal" attribute on the node, but a
"default" attribute on the role, the old one from the node is used.
Which means we really need to remove it to get the new one used.

To minimize config changes, we actually import the password from one
node (which should be good enough in most cases as we allow only one
keystone proposal, so only one node should have the password).
Use new synchronization helpers to avoid races when deploying with HA

There are a number of possible races when deploying keystone for the
first time:

 - when creating of the database / database user
 - when finding the PKI info so it's the same on all nodes
 - when registering the endpoint and creating users in keystone
Merge pull request #199 from vuntz/drop-db-node

Update db password migration script to remove node attributes
Merge pull request #200 from vuntz/sync-marks

Use new synchronization helpers to avoid races when deploying with HA
use clone resources with LSB RA (for now)
use new Chef::Provider::PacemakerCrowbarService