by default let fence-create log everything down to INFO

We use Google+ API for /login/google and “On March 7, 2019, all Google+ APIs and Google+ Sign-in will be shut down completely. This will be a progressive shutdown beginning in late January, with calls to these APIs starting to intermittently fail as early as January 28, 2019.” Therefore, we should update to use google identity instead of Google+.

Support for new data upload flow.

Some major deployment changes:

• Fence configuration for data upload requires DATA_UPLOAD_BUCKET and S3 creds in fence config
• user.yaml format for RBAC is changed; old resources block is still supported, but the proper way to organize the yaml file for user privileges is changed, and looks like this:

rbac:
  policies:
    - id: 'data_upload'
      description: 'upload raw data files to S3'
      role_ids: ['file_uploader']
      resource_paths: ['/data_file']
  resources:
    - name: 'data_file'
    - name: 'programs'
      subresources:
      - name: 'test'
        subresources:
        - name: 'projects'
          subresources:
          - name: 'test'
      - name: 'test_program'
  roles:
    - id: 'file_uploader'
      description: 'can upload data files'
      permissions:
        - id: 'file_upload'
          action:
            service: 'fence'
            method: 'file_upload'

To grant users access for uploading data files, they need the corresponding data_upload policy added:

users:
  [email protected]:
    policies: ['data_upload']

Fence now supports a single YAML file for configuration!

• configuration vars are consolidated, better-described, and have reasonable defaults
• simplification of deployment by having a single cfg file
• backwards-compatible for now, though next major fence release will drop support for local_settings.py
• command line utility to help with creating a new cfg based off the default
• Fence searches configured directories (in settings.py) for the new config.yaml file
• New cfg file has a contextual template-like replacing feature
• Fence now ignores configuration variables it doesn't recognize and loads defaults for cfg not specified
  -It loads in default then overlays the provided configuration over that, discarding any extra config not defined in the default configuration

• more logging for the validation process
• patch to capture more reasons why service accounts got removed in email

• Needed so that previous versions of fence deployed can work with latest version (this) for cronjobs in cloud-automation like user-sync

This came about because a previous version of fence is deployed for DCF but cronjobs are failling because the cloud-automation cronjobs expect a later version of fence but pull the image from whatever's in the manifest

DCF Phase 1 patch - allow google_service_account scope but the scope is not used