ECOM-7207

This means no python, and no build.  Instead, only zero out the
userdata when doing full_edx_installation which assumes a pre-built AMI.

Fix a comment about 12.04

The security role was not run on the base image, meaning that
these tasks were not disabled.  This was causing sandbox builds to fail
if a systemd timer task was also running (which is a bit
nondeterministic to predict unfortunately).

DEVOPS-5273

The playbook the CI job runs trips over the PPA upgrade in
https://github.com/edx/configuration/pull/3470

Instead of making the change just for ansible-provision.sh make the
change for all ansible runs.  Most of them don't currently have this
problem right now but I think it makes sense to make them all consistent
and not have to worry about this problem in the future.

When ansible is going over a NAT Gateway or other intermdiate
network devices, the connection can time out if that device has
its own timeout setting for no traffic.  Setting the ServerAliveInterval
will ensure that there is data sent over the wire ever 30 seconds so the
connection does not get closed while running ansible tasks that take
over 5 minutes.

Now that it can use AWS tokens for auth, we need to be careful about
just dumping env into logs (and thus into splunk).

Because /var/home_jenkins on our jenkins test containers is mounted from
~/path/to/git/repo/.docker_volumes/jenkins_home you end up with an ssh
socket for ansible which is way past the 108 character unix limit for
filenames of sockets.

If you had a sandbox behind an ELB, this would take the whole sandbox
in/out of the ELB during an ansible run?

Also, this file/path won't exist later on sandboxes which also
source this file when running /edx/bin/update

ECOM-4786

ECOM-4729

OIDC doesn't work out of the box if the redirect URI uses http.

I removed this in 9ae2caa0 so it's a no-op

Fixes broken sandbox builds

This has caused confusion in the past. Updated the value to actually be the OAuth2 endpoint, rather than the LMS host.

ECOM-3895

Refactor credentials_url_root to reference CREDENTIALS_DOMAIN (since the
former just adds a protocol and port) and change it to a lowercase var
to convey that it shouldn't be overridden.

OPS-1171