Refactor APB package to have a public exposed API and internal API that handles shared behavior

[shawn-hurley]

Right now bind/unbind/provision/update/deprovsion will all have some similar logic that is not being captured. examples are checking if the namespace exists, checking if the spec has an image, executing the APB cleaning up the sandbox. Some of them (provision/bind) will have to extract the credentials.

I think that this is tied to #248 and we should also think about this from unit testing of callers standpoint (make it easily overridable so that the broker can be unit tested properly).

[rthallisey]

We're going to create a new issue after an in depth vendoring discussion.