Update kolla_config to deal with keystone fernet key rotation
Update kolla_config to deal with keystone fernet key rotation

The kolla config for the keystone container currently copies over
all of the config area using "merge".  This makes sense for most of
keystone's config, but it causes a problem with the fernet keys
used for creating tokens that are stored in the config area.

Good security practices recommend keys be rotated, and keystone
and tripleo both offer the ability for an operator to trigger key
rotation.  The rotation policy limits the number of previous keys
that are retained, which is 5 by default in a tripleo deployment.
The rotation all occurs on the undercloud, and the new set of keys
is provided to the keystone container via the bind mount used for
our kolla config source.  Due to the use of "merge", old fernet
keys that have been deleted on the undercloud due to the rotation
policy will persist for the keystone container since "merge" skips
deletion of files.

This patch adds a second source for keystone's kolla_config, which
is used specifically for the fernet keys.  The fernet key source
has "merge" set to false, and is restricted to the fernet-keys
subdirectory.  This will ensure that any keys that are no longer
present in the kolla config provided by the undercloud are also not
present in the keystone container.

Change-Id: I83d1bfaba321d2fbd5cad1b8fb9478f788f5e238

dprince/tripleo-heat-templates,openstack/tripleo-heat-templates,openstack/tripleo-heat-templates,dprince/tripleo-heat-templates