User Configurable RBAC

For essex, RBAC was added to nova, but the implementation is low level, and not readily explainable to users/deployers. As such, for now RBAC will be documented as experimental and subject-to-change. This blueprint adds an intuitive and stable set of RBAC configuration options that are designed for use by deployers. There are a few ways that this can be done:

* Grouping functionality into categories, and providing a smallish set of summary rules.
* Using rules that map to resources/actions (compute:osapi:servers:list, for example)

Some other considerations:

* Ec2-compatibility
* Inter-project consistency