Decide on validation sets behaviour

[Stanislaw Pitucha]

The original validation sets behaviour was to sign the certificate if any of the validation sets passed completely.

This was intended to be used in scenarios where different groups of servers make different kind of requests to the same Anchor instance. For example operator could configure Anchor to sign certificates for hosts *.nv.domain if the request comes from a nova range and for hosts *.gl.domain if the requests comes from a glance range.

This was changed in commit 52fefc1ca6ea50786b50d473d4069fc1414ef4c7 so that requests require passing all validation sets.

There are two ways forwards I see:
- restore the original behaviour if needed, or
- remove validation sets, because they're not required anymore (merging all validators into one set doesn't change the behaviour)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/190086

[Stanislaw Pitucha (stanislaw-pitucha)]

The above fix is for the first scenario. It's not the only possible solution though.
Comments welcome!

[OpenStack Infra (hudson-openstack)]

Change abandoned by Stanislaw Pitucha (<email address hidden>) on branch: master
Review: https://review.openstack.org/190086
Reason: Will be superseeded by the /v1 API patch.