Configurable cert locations for token signing

Otherwise cloud admins can't really provide their own certificates
without putting them into the default locations (and hoping that nobody
runs keystone-manage pki_setup).

Depends on https://github.com/crowbar/barclamp-keystone/pull/84, thus only looking at https://github.com/saschpe/barclamp-keystone/commit/6f328157548057f093b9a49a8f55c38cc6c2763d will be enough