snf-ci: Patch kamaki to use CA certificates

Patch kamaki clients to use ca_certs path found in kamakirc file or to
completely skip SSL verification using the '--ignore-ssl' flag.
burnin: Patch kamaki to use CA certificates

Patch kamaki clients to use ca_certs path found in kamakirc file or to
completely skip SSL verification using the '--ignore-ssl' flag.

Bump kamaki version dependency to '>= 0.13rc5'.
deploy: Add PITHCAT_UMASK setting to snf-image

PITHCAT_UMASK is needed so if archipelago does not run as root.
If missing the pithcat (e.g. needed for shared-filer ext provider)
becomes really slow.

Up until now we had /etc/default/snf-image as a template with
default snf-image settings commented. These settings were never
updated and as a result were different from the ones the package is
shipped with. This patch, after package installation, moves original
/etc/default/snf-image to snf-image.orig and then overrides it with
the template that includes only the settings that deploy want to
change.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Disable IPv6 on testing VM

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Download base image once

Image and Kamaki downloads the debian base image. In order
to download it just once we store it under /tmp and check
if it exists before downloading it again.

Use -4 option in wget in order not to use IPv6.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: Let archipelago run as synnefo:synnefo

Currently archipelago can runs as non root (archipelago:archipelago
by default). Synnefo conf files are shipped as root:www-data for
security issues. There is a known bug in gunicorn that does not set
supplementary groups when changing uid [1]. Therefore gunicorn
should run with group www-data. In order Pithos and Cyclades to be
able to work with archipelago gunicorn must run with the same user.
Let this user be synnefo, the one that snf-common adds upon
installation.

In short make archipelago run as synnefo:synnefo, gunicorn
as synnefo:www-data, and snf-dispatcher as www-data:www-data

Since we are using NFS we create synnefo group with common
gid across all nodes. The archipelago dir to be exported
will be root:synnefo.

Due to a bug in archipelago [2] we chown /dev/shm/posixfd after
archipelago restart.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=762448
[2] https://github.com/grnet/archipelago/pull/44

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Mention the synnefo group in upgrade notes

Synnefo will run as www-data:synnefo while archipelago as
archipelago:synnefo. Mention the changes that should be
made after package installation wrt mods and permissions.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>