General baremetal node auth and token passing mechanism

Define security levels for node auth:
0 - no auth
1 - auth with hardware id (like S/N of bios, hdd etc.)
3 - auth with user pre-share key
This value should be stored in node secure storage.

1) Before deploy user sets some values for node in secure storage via Ironic API,
like this:

{
   "hardware_id": sha1(sha1(hardware_id) + node_uuid)
   "user_key": sha1(sha1(user_key) + node_uuid)
    ....
   "vendor_sn": sha1(sha1(vendor_sn) + node_uuid)
}

2) Node pass own info via special API method for node

{
   "hardware_id": sha1(hardware_id)
   "user_key": sha1(sha1(user_key)
    ....
   "vendor_sn": sha1(sha1(vendor_sn) + node_uuid)
}

3) Ironic compares this data sets, and disallow operation with node if 1 or more keys does not match or too few parameters for defined security level.

4) Ironic uses Keystone OS-OAUTH1 extension for grant temporary access to the API,
(should validate request token from node):
http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-oauth1-ext.html#authorize-request-token-put-os-oauth1authorizerequest_token_id

Gerrit topic: https://review.openstack.org/#q,topic:bp/baremetal-node-secure-auth,n,z

Addressed by: https://review.openstack.org/159819
    Do not save auth token on TFTP serfer in PXE driver

Yuriy, is there a spec for this?
// jroll 2015-10-15

We're moving from using blueprints to track features to RFE bugs. I've filed one for your change (see related bugs section). Please track further work there using Closes-Bug, Partial-Bug or Related-Bug in commit messages and use this newly created RFE bug.
//vdrok 2015-12-16