Make service tenant name configurable in keystone::roles::admin

Though "services" seems to be a fairly common name for the service
tenant, some people may prefer to use "service" or some other name.

The puppetlabs-glance module, for one, does allow overriding the
service tenant name.

Signed-off-by: Florian Haas <florian@hastexo.com>