Make service tenant name configurable in keystone::roles::admin

Though "services" seems to be a fairly common name for the service
tenant, some people may prefer to use "service" or some other name.

The puppet-glance module, and others, do allow overriding the
service tenant name.

Change-Id: I4764cbf21821db96fac93ea4abdaf7d14bd12771