parameterize machine names in edx-west playbooks -- to edx-west/release

Added a validation on the machine variable, expected to be passed in
from the command line now, so that the worker play only works on
machines named "util" and the app play on machines named "app".
Otherwise it would be too easy to mix those up.

Now that we're using -e command line options, it's easier to use this to
specify the "modify_db" variable than prompt_vars.  Having every install
block on this question before was such a hassle!  Now we just won't
migrate unless you explicitly say so on the ansible command with
"migrate_db=yes" or "migrate_only=yes".

use local temp dir for sockets and ansible cache

I was having problems where concurrent installs could trample on each
other.  The instance that immediately affected me was output caching
from ec2.py: the output of that command is different between staging and
prod, and both were being written to /tmp/ansible_ec2.cache and .index.

Fix here is to write to a local temp directory.  This creates empty temp
dirs to ensure that they are created in all repos.

While less likely, you could have collisions on named ssh sockets.
Those are named with just the instance name, which could be re-used
across VPC's.  Putting those in the ./tmp dir too prevents that.

Note that for consistency I did away with just the plain ec2.ini file,
and instead now there are prod- and stage- variants.  This is clean but
now means that you'll need to change your install command to look
something like this:

    ANSIBLE_EC2_INI=prod-ec2.ini ANSIBLE_CONFIG=prod-ansible.cfg ansible-playbook -c ssh -u ubuntu -i ./ec2.py prod-app.yml

edx-west: clean up users, remove two unused plays (*-log.yml)

Our user lists were a mishmash, this standardizes them across major
machine types (app servers and workesrs).

On the jumpbox also add Sherif Halaway.  Alejandro was already
provisioned there, adding now as cleanup.

The log machines were abandoned long ago.

Turn off hash merge, add gh_user_no_sudo

It's handy to be able to create users that *don't* have sudo rights.
Here at Stanford we use this to add users to our VPC bastion box (ssh
proxy) so these users can use this machine for ssh tunneling, but I
don't want to give those users the keys to the kingdom.

This let's me configure a playbook like this.

   roles:
     - common
     - supervisor
     - role: gh_users
       gh_users:
         - su1
         - su2
         - su3
       gh_users_no_sudo:
         - normal1
         - normal2

The new gh_users_no_sudo list can be empty.

We have still consolidated the unicorn processes, but we need separate
nginx configs for lms and lms-preview for preview to have basic auth.

* Supervisor log names were being interpolated incorrectly, resulting in
  names like lmstderr.log, rather than lms-stderr.log. This fixes it.
* Also puts xqueue logs in the right place.
* SEND UPSTREAM

* Updates to certs variables to support patches in flight from Stanford
* SEND UPSTREAM

Edx west/release merge

Conflicts:
	playbooks/roles/edxapp/templates/edx-workers.conf.j2