work fine when the nodes are behaving themselves.

1) geni_update_users: Takes a slice credential and a keys argument. Can
  only be invoked when the sliver is in the started/geni_ready state.
  Moves the slice to the geni_updating_users state until all of the
  nodes have completed the update, at which time the sliver moves back
  to started/geni_ready.

2) geni_updating_users_cancel: We can assume that some nodes will be whacky
  and will not perform the update when told to. This cancels the
  update and moves the sliver back to started/geni_ready.

A couple of notes:

* The current emulab node update time is about three minutes; the
  sliver is in this new state for that time and cannot be restarted or
  stopped. It can of course be deleted.

* Should we allow restart while in the updating phase? We could, but
  then I need more bookkeeping.

* Some nodes might not be running the watch dog, or might not even be
  an emulab image, so the operation will never end, not until
  canceled. I could add a timeout, but that will require a monitor or
  adding DB state to store the start time.