Fixes #11579 - Reports show/destroy restricted by host authorization (CVE-2015-5233)

ReportsController 'show' and 'destroy' now perform a check to see if
the User is authorized to see the Host associated with the Report. In
case it's not, it returns 404, as to not give hints whether a Report...

Fixes #10963 - partition table can't access os ids

(cherry picked from commit 5fc2aed63fa0ab78432bbf91dbfd61c2543dfc97)

Refs #10720 - Use API v2 response for vm_compute_attributes

Fixes #6976 - Build default PXE menu should be POST request

Fixes #7096 - Adds STI to templates

This commit converts Ptables to be just another type of Template so it
gets the same features as ConfigTemplate. ConfigTemplate was renamed to
ProvisioningTemplate to reflect UI and the name under it's commonly known.

fixes #10720 - Adds API to get host vm attributes

This exposes an API to fetch a host's vm_compute_attributes,
such as vmware cpus and memory. It lives at a separate endpoint
because it involves a fetch for data from the compute resource,
and may have different performance characteristics than the database.

Fixes #10715 - api build_pxe_default returns non-JSON message

The fix adds a new method `render_message` for responding with a status
text.

fixes #9031 - Add routes to view template_combinations per hostgroup / environment

fixes #10482 - get external user group members only once during refresh

fixes #9812 - Adds validation on override value, ensure match returns error if blank