Limited use trusts

Trusts now have a "remaining_uses" field that track how many times
a trust can still issue a token. It is decremented each time a
trust related authentication occurs. If set to null, trusts can be
used indefinitely to authenticate.

Fix for bug #1250617

Change-Id: I739cd583eea2363724b888e9c2b9b9158a9838c1
Correct OS-TRUST extension expires_at responses

All of the GET responses contain expires_at, which from speaking
to the original author I understand is an ommission to the docs
due to the code getting subsequently updated.

So to align the docs with the real API responses, add an expires_at
to each of the example responses.

Change-Id: Ifdfb9df04c730cf2f79a5e79daccf9a24342556d
Add IdP management extension (Federation pt1)

Add an extension to manage IdPs, this is required for adding federation
support to keystone.

Co-Authored-By: Kristy Siu <kwss@kent.ac.uk>
Co-Authored-By: David Chadwick <d.w.chadwick@kent.ac.uk>
Co-Authored-By: Joe Savak <jsavak@gmail.com>
Co-Authored-By: Marek Denis <marek.denis@cern.ch>
Co-Authored-By: Dolph Mathews <dolph.mathews@gmail.com>

Implements: blueprint virtual-idp
Change-Id: I783d85748d4c051ee685a5b54a824a7d461e1860
Merge "Add IdP management extension (Federation pt1)"
Key Distribution Server

API for distribution of keys in support of:
https://wiki.openstack.org/wiki/MessageSecurity#Key_Derivation

SecurityImpact
DocImpact

Change-Id: Ic00009e635f81427ba909a9ce4ba168f14ff51df
Merge "Key Distribution Server"
Merge "Limited use trusts"
Merge "Correct OS-TRUST extension expires_at responses"