Make ssh-host-key-policy configurable

Make ssh-host-key-policy configurable

This patch adds configuration options for ssh_hosts_key_file and
strict_ssh_host_key_policy.  You can set strict_ssh_host_key_policy
to 'True' or 'False'.  If set to false the first connection of a host
will cause it to be added to the known_hosts file.  Subsequent connections
will be enforced against the existing key.  Changes in the key are assumed
to be a Man-in-the-Middle attack so the connection is rejected.

If strict_ssh_host_key_policy is 'True' the key for the host that is
being connected to must be in the hosts_key_file.  No first connection
assumptions are made.

strict_ssh_host_key_policy is set to 'False' to keep functionality similar
to the existing functionality.

With this patch, a default of $state_path/ssh_known_hosts is used for the
known_hosts file.  Unlike the previous approach, this now requires the
user to have a known_hosts file that is writable, somewhere.  The option
is configurable if they don't want to use $state_path/ssh_known_hosts

DocImpact:  Need to document the new strict_ssh_host_key_policy as well
as the ssh_hosts_key_file.  A note should be made for drivers that may
pass a hosts_key_file via kwargs when creating an ssh pool: their file
will be loaded along with the file configured via /etc/cinder.conf.
Also worth noting, for development environments, an ssh_hosts_key_file of
/dev/null and a strict_ssh_host_key_policy setting of 'False' may be used.
Using those setting will ignore these changes.

Change-Id: Ia7a747224dbb08528f3c7a51da4cd4a6bf0eac1c
Implements-blueprint: configurable-ssh-host-key-policy