added module to handle roles on Keystone

I think it's better to have separate implementations for each
object on Keystone. Not to mix several objects, like in
keystone_user at the moment.