fixes #3272 - allow 'admin' account to be removed and replaced

Summary of changes:

* "admin" is no longer special.  The test fixture for this login has been renamed to prove this.
* Where we used the admin account for internal actions (e.g. creation of users on the fly), the "anonymous admin" replaces it.  I think this has been kept to a minimum.
* Where API access is anonymous (either OAuth without user mapping, or the unauthed Puppet APIs), the "anonymous API admin" replaces it.
* A new hidden auth source hides these two anonymous users.
* Seeding now generates a randomised password (printed to stdout), and all of the details about the initial user account can be changed from env vars (see https://github.com/theforeman/puppet-foreman/pull/190 for usage).
* All references to "admin" as a hardcoded login have been fixed to refer to the test fixture for more flexibility.