Fix elements to not return config-* roles

BNC#865811

e.g:

    $ crowbar network elements

previously returned network-config-default as well, in which we're not
interested.

It uses ProposalObject#all_elements instead of RoleObject + filter.
Make the constraint checks reusable
Do not return nodes that do not pass a constraint

BNC#865811

E.g.:

     $ crowbar keystone element_node keystone-server

should not return any admin nodes, as they cannot be assigned to the
keystone-server.