ssl: Add playbook for constrained deploy

We need a playbook to quickly and surgically update the SSL certificates of a cluster without needing to bounce all services or take a control plane outage. This playbook provides that ability.
Using [Ansible Tags](http://docs.ansible.com/playbooks_tags.html) I was able to limit the tasks to an explicit subset. I am happy with this solution.

```
$ ./bin/ursula -e envs/test -p playbooks/ssl-cert.yml -x "--syntax-check --list-tasks --tags ssl"

playbook: playbooks/ssl-cert.yml

  play #1 (all):
    custom CA cert directory
    (possibly self-signed) ssl cert
    file dest=/opt/stack/ssl state=directory
    template src=openstack.crt dest=/opt/stack/ssl/openstack.crt mode=0644
    pip name=httplib2 version=0.8
    pip name=requests version=1.2.3
    file src=/etc/ssl/certs/ca-certificates.crt dest={{item}} owner=root mode=0644 state=link force=yes
    use system httplib2 and request Python modules that already use system CA certs
    lineinfile dest=/etc/ca-certificates.conf regexp=openstack/{{endpoints.main}}.crt line=openstack/{{endpoints.main}}.crt


  play #2 (openstack controller services):
    install ssl cert+key

  play #3 (swift code and config):
    install ssl cert+key
```