fix(tests): data containers should not be shared

Fixes #1964
chore(*): bump CoreOS to 452.0.0

This addresses a security vulnerability with bash.

See the release notes at https://coreos.com/releases/#452.0.0
Revert "docs(contrib/rackspace): add manual update instructions"

This reverts commit f46b7ea17e33f38d32cc8cfa732d010591853db6.

Conflicts:
	contrib/rackspace/README.md
ref(units): replace bash commands with network connections with ncat.
fix(deisctl/units): fix ncat loop in builder and registry
Merge pull request #1940 from carmstrong/coreos_452.0.0

chore(*): bump CoreOS to 452.0.0
Merge pull request #1969 from johanneswuerbach/database-tests

fix(tests): data containers should not be shared
docs(vagrant): bump version to v1.6.5
Merge pull request #1977 from bacongobbler/bump-vagrant

docs(vagrant): bump version to v1.6.5
fix(controller): work around fleet state reporting on deis run
fix(controller): bump timeout to 20 min for image to download
Merge pull request #1978 from gabrtv/fix-deis-run

fix(controller): work around fleet state reporting on deis run
ref(scheduler): introduce deis/publisher

In Deis's scheduler abstraction, we run a "sidecar" systemd unit which
publishes the running host and port of the application to etcd for
service discovery.

The issues with this sidecar container are as follows:

- it must live on the same host as the container
- it must wait for the container to come up before publishing
- it relies on using the docker client directly

The last point is crucial. This means that we are effectively
monitoring the docker client for container uptime, which is not the
same as monitoring the container directly.

This has been refactored into a micro-service image called
deis/publisher. Publisher listens directly to a docker socket
bind-mounted into the container and listens to the docker events API
for running containers. Running containers that follow the same format
as our current naming scheme (e.g. hardy-woodsman_v2.web.1) are
published to etcd for service discovery. This allows us to remove the
hard dependency on running a sidecar container to publish the app
container to etcd. Instead, one container per host publishes all
apps running on that host.

MIGRATING: to migrate to this change from existing hosts, you can run
the following:

    ><> # rsync publisher/systemd/deis-publisher.service to every node
    ><> for i in deis-1.example.com deis-2.example.com; do ssh core@$i -c "sudo systemctl enable /home/core/deis-publisher.service && sudo systemctl start /home/core/deis-publisher"

Then, you'll want to remove each announce sidecar attached to the applications:

    ><> fleetctl destroy <appname>-_<version>.<proctype>.<conatiner ID>-announce
feat(deisctl): add deis/publisher

With this change comes the introduction of the ability to add global
units to the project. Before, we would always prepend "@1" to the units
because we always assumed they'd be scalable. This is not the case for
global units, so I reverted that behaviour.
fix(publisher): use git sha tag for `make build`
fix(publisher): fixup entrypoint
Merge pull request #1708 from bacongobbler/publisher

ref(scheduler): introduce deis/publisher