heat add HEAT_DEFERRED_AUTH option

Adds a HEAT_DEFERRED_AUTH, defaulted to trusts, so users can
by default take advantage of the heat trusts functionality
which provides the following benefits:
- Deferred operations (e.g autoscaling) work with token-only auth
- The password field in the heat page of horizon can be made optional
  (horizon patch pending)
- It's more secure because heat no longers stores username/password
  credentials in the DB, only a trust ID.

The previous behavior can be obtained by setting HEAT_DEFERRED_AUTH
to something other than "trusts" - the value will only be set in
the heat.conf if the value of "trusts" is found, otherwise the
heat.conf default will be used (currently "password" which doesn't
use trusts)

Change-Id: I549f1e0071a082ac5d07d0f99db633f8337f3d87
Related-Bug: #1286157
Merge "heat add HEAT_DEFERRED_AUTH option"