Turn off hash merge, add gh_user_no_sudo

It's handy to be able to create users that *don't* have sudo rights.
Here at Stanford we use this to add users to our VPC bastion box (ssh
proxy) so these users can use this machine for ssh tunneling, but I
don't want to give those users the keys to the kingdom.

This let's me configure a playbook like this.

   roles:
     - common
     - supervisor
     - role: gh_users
       gh_users:
         - su1
         - su2
         - su3
       gh_users_no_sudo:
         - normal1
         - normal2

The new gh_users_no_sudo list can be empty.

We have still consolidated the unicorn processes, but we need separate
nginx configs for lms and lms-preview for preview to have basic auth.

* Supervisor log names were being interpolated incorrectly, resulting in
  names like lmstderr.log, rather than lms-stderr.log. This fixes it.
* Also puts xqueue logs in the right place.
* SEND UPSTREAM

* Updates to certs variables to support patches in flight from Stanford
* SEND UPSTREAM

Edx west/release merge

Conflicts:
	playbooks/roles/edxapp/templates/edx-workers.conf.j2

Merge branch 'edx-west/release-merge' of github.com:edx/configuration into edx-west/release-merge-attempt-release

More tuning to recipes to get an integrated worker stack to install
properly under the new régime.