[rfe] modify our usage of privsep in nova

[Sylvain Bauza]

Nova compute services use the privsep library [1] for specific 'root' privilege usage for a command or a direct call to the system.

Unfortunately, our current usage we do from this library is not really a good recommendation : instead of using a sysadmin context that uses *all* privileged caps for any caller we have [2], we should rather define a per-call context with specific caps.

[1] https://docs.openstack.org/oslo.privsep/latest/user/index.html
[2] https://github.com/openstack/nova/blob/c97507dfcd57cce9d76670d3b0d48538900c00e9/nova/privsep/__init__.py#L21-L31

[Jorge San Emeterio (jsanemet)]

I will post my proposal and more at the following etherpad: https://etherpad.opendev.org/p/nova-privsep-review