apiserver: fetch identity public key lazily

[rogpeppe]

If the identity server isn't available the first time
a remote user tries to log in, we don't want all
remote user logins to fail forever (or until the
API agent is restarted), so we don't try to
fetch the public key immediately, instead
relying on httpbakery.PublicKeyRing to do it
for us when needed.

To QA, bootstrap a controller with identity-url set to a
host that's not running a discharge server. Try to log
in to it as an external user; verify that this fails.
Then start up the discharge server and verify that
it's possible to log in.

Fixes https://bugs.launchpad.net/juju/+bug/1713048

[fabricematrat]

LGTM

[rogpeppe]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://ci.jujucharms.com/job/github-merge-juju

[jujubot]

Build failed: Tests failed
build url: http://ci.jujucharms.com/job/github-merge-juju/192

[rogpeppe]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://ci.jujucharms.com/job/github-merge-juju