lock_user/unlock_user changes:
 - pass user.id/app.id instead of user/app mongoid objects.
   This will help anyone with bson id does not have to fetch corresponding mongoid model to acquire user lock (eg: oo-admin-repair)
 - app.id is optional to acquire user lock. Once user lock is acquired, no one should get application lock to avoid deadlocks.
Added User pending-op-group/pending-op functionality
Added pending op groups for user add_ssh_keys/remove_ssh_keys
User pending-op/pending-op-group fixes
Fixes to add_ssh_key/remove_ssh_key user op

Add application_locked? method to check if the app is already locked or not.

Misc fixes
Check if app has private ssl cert capability to allow add/update alias after acquiring app lock
Fix test cases
Fix oo-admin-clear-pending-ops script

Bug fixes