fixes #3272 - allow 'admin' account to be removed and replaced

Summary of changes:

* "admin" is no longer special.  The test fixture for this login has been renamed to prove this.
* Where we used the admin account for internal actions (e.g. creation of users on the fly), the "anonymous admin" replaces it.  I think this has been kept to a minimum.
* Where API access is anonymous (either OAuth without user mapping, or the unauthed Puppet APIs), the "anonymous API admin" replaces it.
* A new hidden auth source hides these two anonymous users.
* Seeding now generates a randomised password (printed to stdout), and all of the details about the initial user account can be changed from env vars (see https://github.com/theforeman/puppet-foreman/pull/190 for usage).
* All references to "admin" as a hardcoded login have been fixed to refer to the test fixture for more flexibility.

Merge https://github.com/theforeman/puppet-foreman/pull/190 after this one.
Since you are already making a change here related to the position of this seed, I'll inquire to see about a change. This makes user creation the last entity to be seeded. For some of our Katello operations we need a user to be present whether to perform an operation or to associate entities initially. Is there any reason that setting up the user seeds isn't the first thing done?