Power off commands should give guests a chance to shutdown

Currently in libvirt operations which power off an instance such as stop,
shelve, rescue, and resize simply destroy the underlying VM. Some
GuestOS's do not react well to this type of power failure, and so it would
be better if these operations followed the same approach as soft_reboot
and give the guest as chance to shutdown gracefully.

The shutdown behavior is defined by two values:

- shutdown_timeout defines the overall period a Guest is allowed to
complete it's shutdown.  The default valus is set via nova.conf and can be
overridden on a per image basis by image metadata allowing different types
of guest OS to specify how long they need to shutdown cleanly.

- shutdown_retry_interval defines how frequently within that period
the Guest will be signaled to shutdown.  This is a protection against
guests that may not be ready to process the shutdown signal when it
is first issued. (e.g. still booting).  This is defined as a constant.

This is one of a set of changes that will eventually expose the choice
of whether to give the GuestOS a chance to shutdown via the API.

This change implements the libvirt changes to power_off() and adds
a clean shutdown to compute.manager.stop().

Subsequent patches will:
- Add clean shutdown to Shelve
- Add clean shutdown to Rescue
- Convert soft_reboot to use the same approach
- Expose clean shutdown via rpcapi
- Expose clean shutdown via API

Partially-Implements: blueprint user-defined-shutdown
Closes-Bug: #1196924
DocImpact

Change-Id: I432b0b0c09db82797f28deb5617f02ee45a4278c
Merge "Power off commands should give guests a chance to shutdown"