Cells: Event-based secgroup/rule/assoc syncing

- ec2 security groups with source groups
- create security group if it doesn't exist on rule create
- management command to force a sync of secgroups down cells

Change-Id: Ibc8c5acb6062e12bc876aff10ec1201b55d228eb
Cells: DB healing for groups/rules/instance assocs

Change-Id: I0721f1eb7f971da4d55cee027c8a4136f6f8b0e7
Healing for EC2 inst/vol and S3 image mappings
Expire reservations in cells manager

Normally reservations are expired by a periodic task in nova-scheduler.
In a cells deployment quotas are usually enabled only on the api-level
cell. This uses a separate DB from the scheduler, so any reservations
on the top level never get expired.

This change adds the same periodic task to the cells manager so
reservations at all levels have a chance to be expired. The task is
disabled by default and can be turned on with the
CONF.cells.expire_reservations option.

Change-Id: I217f5b5e947662a858eb295f2add5c3227c3b531