Bind mount mistral state for external deployments

External deployments, like openshift-ansible, rely on
contents of /var/lib/mistral and /usr/share/ansible/
host paths. Bind mount those to allow containerized
mistral access data required for external deployments.
Allow only executor to write into /var/lib/mistral.
The other non-API components are only allowed to read.

Change-Id: I4299442de0efaa66253ecc45acb2d0a8c082f018
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>

docker/services/mistral-engine.yaml

@@ -110,6 +110,8 @@ outputs:
                   - /var/lib/kolla/config_files/mistral_engine.json:/var/lib/kolla/config_files/config.json:ro
                   - /var/lib/config-data/puppet-generated/mistral/:/var/lib/kolla/config_files/src:ro
                   - /var/log/containers/mistral:/var/log/mistral
+                  - /var/lib/mistral:/var/lib/mistral:ro
+                  - /usr/share/ansible/:/usr/share/ansible/:ro
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
       host_prep_tasks:

docker/services/mistral-event-engine.yaml

@@ -110,6 +110,8 @@ outputs:
                   - /var/lib/kolla/config_files/mistral_event_engine.json:/var/lib/kolla/config_files/config.json:ro
                   - /var/lib/config-data/puppet-generated/mistral/:/var/lib/kolla/config_files/src:ro
                   - /var/log/containers/mistral:/var/log/mistral
+                  - /var/lib/mistral:/var/lib/mistral:ro
+                  - /usr/share/ansible/:/usr/share/ansible/:ro
             environment:
               - KOLLA_CONFIG_STRATEGY=COPY_ALWAYS
       host_prep_tasks:

docker/services/mistral-executor.yaml

@@ -125,6 +125,7 @@ outputs:
                   - /var/run/docker.sock:/var/run/docker.sock:rw
                   - /var/log/containers/mistral:/var/log/mistral
                   - /var/lib/mistral:/var/lib/mistral
+                  - /usr/share/ansible/:/usr/share/ansible/:ro
                 - {get_param: MistralExecutorVolumes}
                 - {get_param: MistralExecutorExtraVolumes}
             environment: