Implement local macaroon logins

[axw]

Reintroduce the "login" command, with a new approach
using macaroons. This is in addition to the existing
external-IdM macaroon support.

We now support macaroon logins for local users: if a
local user tag is specified in login, a macaroon may
be provided instead of a password.

We can now record a macaroon in accounts.yaml instead
of a password. When you run "juju login", you will be
prompted for your password, which will be used for the
login; a macaroon is requested from the server, which
is then written to disk and any existing password
wiped from accounts.yaml.

The change-user-password command is similarly updated
to manage macaroons.

TODO:

• update "juju register" to generate and record macaroons
• update juju/api.go code to prompt user to run "juju login"
  if the macaroon is expired
• persist root keys in mongo, so logins work across
  controller machines
• garbage collect root keys after macaroon expiry

(Review request: http://reviews.vapour.ws/r/4265/)

[axw]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

[jujubot]

Build failed: Tests failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/6986

[axw]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju