oauth1 extension migration fails with DB2

Running keystone-manage db_sync --extension oauth1 would fail when
using DB2 with an error that the REQUESTED_ROLES column isn't
defined on the REQUEST_TOKEN table.

This problem is worked around by dropping the NULL constraint
first and then renaming the column.

Change-Id: I58438cad4d645c553da5710455e8a219b8fd3014
Closes-Bug: #1284740
Implement V3 Specific Version of EC2 Contrib

Implement an EC2 Controller that returns a V3 token when invoked
via the V3 pipeline. Moved all code except the `authenticate` method
into a common base class mixin. `authenticate()` has become an
abstract method. Shared code from `authenticate()` was moved into
`_authenticate()`.

V3 specific router definition added that makes use of the new V3
specific controller.

For upgrade purposes:
* The paste.ini for keystone will need to be modified to include
  the new V3 ec2credentials in the pipeline as is documented in
  the updated sample paste.ini.
* Policy.json updated to provide rules for the new V3 EC2credential
  CRUD as show in the updated sample policy.json and
  policy.v3cloudsample.json

For authentication that occurs via the V3 ec2credential system,
the response auth_method (encoded in the token) will be
"ec2credential". This should have no impact on using
or consuming the token itself but can be used to identify if
the token was issued via the Ec2ControllerV3.authenticate
method.

The V2 version of ec2credential controller has been marked
as deprecated to keep in line with the rest of the V2 API
being deprecated (slated for removal in K).

DocImpact
UpgradeImpact

Change-Id: Iaf1e05a1beef481385c6eb19d7f54cdc84b5b5df
Closes-Bug: #1269947
bp: deprecated-as-of-icehouse
Merge "Implement V3 Specific Version of EC2 Contrib"
Merge "oauth1 extension migration fails with DB2"