Configurable cert locations for token signing

Otherwise cloud admins can't really provide their own certificates
without putting them into the default locations (and hoping that nobody
runs keystone-manage pki_setup).