Encode/Decode LDAP parameters to/from UTF-8

The python-ldap API only accepts UTF-8 encoded strings therefore any
unicode values must be encoded to UTF-8 prior to passing to
python-ldap and conversely UTF-8 encoded strings returned from
python-ldap need to be decoded back from UTF-8 into unicode.

Need to use unicode() rather than str() to properly handle non-ascii
characters, but to be PY2/PY3 compatible use six.text_type.

Very few of the ldap tests were using non-ascii values, in fact
non-ascii values were restricted to only specific tests that
had 'unicode' in their test name. This is very weak test coverage.
Replace all occurances of 'fake', the standard string
used in the tests for test value with 'fäké' where the a has an
umlaut and the e has a diacritical. Visually they look almost the
same but will trigger the type of encoding exceptions we've seen
in the past.

This is the minimal backport for icehouse from the following
master commits:
https://review.openstack.org/#/c/82396/
https://review.openstack.org/#/c/82398/
https://review.openstack.org/#/c/82399/

Closes-Bug: #1172106

Change-Id: I6b328dfc8435457a8d7ff16320f3d869cfa1043c
Block delegation escalation of privilege

Forbids doing the following with either a trust
  or oauth based token:
  creating a trust
  approving a request_token
  listing request tokens

Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2
Closes-Bug:  1324592
Merge "Encode/Decode LDAP parameters to/from UTF-8" into stable/icehouse
Make sure domains are enabled by default

Domains without an explicit 'enabled' key in the dict will now be
handled in the same way as projects are. This will ensure that
the KVS backend produces the same result as the SQL backend for
assignment.

Change-Id: I3b6d26278329841cfe1be5ce7f67ba6d3569785f
Related-Bug: #1311142
Properly invalidate cache for get_*_by_name methods

Use the original name for invalidating the cache on the
get_project_by_name and get_domain_by_name when performing update
operations on the name attributes.

Change-Id: If58a3b0a47501096f9fa9eb9cd7a6057f7b29298
Closes-Bug: #1311142
Bump stable/icehouse next version to 2014.1.2

Change-Id: Id7181755d3609c0ae91c2402b34f2de02c06a1f0
Merge "Make sure domains are enabled by default" into stable/icehouse
Merge "Properly invalidate cache for get_*_by_name methods" into stable/icehouse
Updated from global requirements

Change-Id: I8402f264446d94c43d00ef56fd0eb43a1551d979
Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

(cherry picked from commit 1556faec2f65dba60584f0a9657d5b717a6ede3a)

Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
Closes-Bug: #1331912
HEAD responses should return same status as GET

According to the HTTP spec, a HEAD request should return the same
status and headers as the GET request (including content-type and
content-length). The HEAD request simply strips out the body and
returns no body. Any case where HEAD routing returned a different
status code than GET, now returns the same status and headers.

Any case where HEAD was supported where GET was not supported now
supports both GET and HEAD.

The wsgi.render_response code now handles HEAD appropriately and
will maintain headers while enforcing no body data is returned.

The bulk of this change is to support the same behavior between
deploying Keystone under eventlet and under HTTPD + mod_wsgi. In
the case of deploying under HTTPD + mod_wsgi, there are cases
where mod_wsgi will turn a HEAD request into a GET request to
ensure that the proper response is rendered. With these changes
all HEAD responses will respond in the same manner under either
eventlet or mod_wsgi.

Change-Id: I13ce159cbe9739d4bf5d321fc4bd069245f32734
Closes-Bug: #1334368
(cherry picked from commit 82101a36d348ad0c3de10f455878828f4263ffe2)
Merge "Updated from global requirements" into stable/icehouse
Merge branch 'stable/icehouse' of https://github.com/openstack/keystone into icehouse