It's handy to be able to create users that *don't* have sudo rights.
Here at Stanford we use this to add users to our VPC bastion box (ssh
proxy) so these users can use this machine for ssh tunneling, but I
don't want to give those users the keys to the kingdom.

This let's me configure a playbook like this.

   roles:
     - common
     - supervisor
     - role: gh_users
       gh_users:
         - su1
         - su2
         - su3
       gh_users_no_sudo:
         - normal1
         - normal2

The new gh_users_no_sudo list can be empty.

We have still consolidated the unicorn processes, but we need separate
nginx configs for lms and lms-preview for preview to have basic auth.

* Supervisor log names were being interpolated incorrectly, resulting in
  names like lmstderr.log, rather than lms-stderr.log. This fixes it.
* Also puts xqueue logs in the right place.
* SEND UPSTREAM

* Updates to certs variables to support patches in flight from Stanford
* SEND UPSTREAM

Edx west/release merge

Conflicts:
	playbooks/roles/edxapp/templates/edx-workers.conf.j2

Merge branch 'edx-west/release-merge' of github.com:edx/configuration into edx-west/release-merge-attempt-release

More tuning to recipes to get an integrated worker stack to install
properly under the new régime.

Another wip commit resolving problems installing the util stack. Also,
remove datadog from staging hosts where it's not needed.