Stop creating KeystoneAdmin KeystoneServiceAdmin sysadmin netadmin roles

These roles have absolutely no use anymore since quite some time. And
they were dropped from the sample data in Grizzly:
https://github.com/openstack/keystone/commit/d6f7cbc484868bdec3eeb9d4b0f45b10ce536e79
Rebase keystone.conf to Grizzly.

Actually uncomment sql.idle_timeout. The following options where dropped
from keystone.conf: public_host, admin_host, compute_host, min_pool_size,
max_pool_size, pool_timeout. Use default compute_port (8774), the nova
cookbook does the same. Provide public_endpoint/admin_endpoint for the
v3 API.
Configurable cert locations for token signing

Otherwise cloud admins can't really provide their own certificates
without putting them into the default locations (and hoping that nobody
runs keystone-manage pki_setup).
Merge pull request #84 from saschpe/release/pebbles/master-keystoneconf-grizzly

Rebase keystone.conf to Grizzly.
Merge pull request #89 from saschpe/release/pebbles/master-token-signing

 	Configurable cert locations for token signing
Merge pull request #90 from vuntz/drop-unneeded-roles

Stop creating KeystoneAdmin KeystoneServiceAdmin sysadmin netadmin roles
Fixup of previous pull.
Merge pull request #93 from saschpe/release/pebbles/master-token-signing-fixup

Fixup of previous pull.
SSL support for native frontend
Merge pull request #91 from saschpe/release/pebbles/master-ssl

SSL support for native frontend
Change default for cert_required

This setting is used to require client certificates, which people likely
do not want by default.
Add an attribute to let the user say the certificate is insecure
webui: Fix setting cert_required
Link ca_certs attribute to cert_required in the UI

If cert_required is false, then ca_certs will not really matter.
Fail early if certificate files are missing
Merge pull request #94 from vuntz/ssl-fixes

https://github.com/crowbar/barclamp-keystone/pull/94

Merged by devtool for cloudsleuth
Provide keystone protocol to keystone.conf, used in v3 endpoints
Register endpoints with public name and FQDN when possible

When using SSL, the common name field in the certificates is checked,
and using IP addresses won't work with that.

Internally to the OpenStack setup, it is always fine to use the FQDN
from the node, so we use this in the internal and admin URLs of the
endpoints.

For the public URL, we prefer to use the public name if it is set. If it
it not set, then we use the public FQDN only if SSL is enabled;
otherwise, we prefer the IP address (like before) because we're not 100%
sure that the administrator will have completed a proper DNS setup where
the public FQDN generated by Crowbar will be announced externally.
Correctly set endpoints in keystone.conf too
Allocate public IP address to keystone-server nodes

The keystone server needs to be accessible from the external network, so
that OpenStack command line tools work.