This commit migrates roles from named groups to a relational table.

These keys are now objects with a limited interface, and the particular
internal representation is managed by the data storage layer (the
modulestore).

For the LMS, there should be no outward-facing changes to the system.
The keys are, for now, a change to internal representation only. For
Studio, the new serialized form of the keys is used in urls, to allow
for further migration in the future.

Co-Author: Andy Armstrong <andya@edx.org>
Co-Author: Christina Roberts <christina@edx.org>
Co-Author: David Baumgold <db@edx.org>
Co-Author: Diana Huang <dkh@edx.org>
Co-Author: Don Mitchell <dmitchell@edx.org>
Co-Author: Julia Hansbrough <julia@edx.org>
Co-Author: Nimisha Asthagiri <nasthagiri@edx.org>
Co-Author: Sarina Canelake <sarina@edx.org>

[LMS-2370]

Add some optional policies around password resets, such as password reuse, forced password resets, allowed frequency of password resets

Add optional feature to lock out accounts after N failed login attempts. Lockouts will last M seconds.

add DB migration and fix earlier mistakes in student migration history

add tests and fix bugs that came out of those unit tests

remove unused import

pep8/pylint

address some PR feedback

fix tests

fix broken test

try to mock time

use freeze-gun to overload the system time to simulate the future

Extend the capabilities of the REGISTRATION_OPTIONAL_FIELDS
configuration variable, to allow to select, for each individual field,
if it should be 'hidden', 'optional' or 'required'.

Rename the configuration variable to REGISTRATION_EXTRA_FIELDS to reflect
the additional capabilities, and updates the defaults.

As extra fields, configurable through the REGISTRATION_EXTRA_FIELDS
variable. Hidden by default.

Tickets: MCKIN-168 MCKIN-184

Note: Studio also has a registration page, which uses the same account
creation page. It should be possible to use it without requiring the
variable from the LMS, as the fields are different.