switch to using a setup role

- only one node runs registry-setup role
- all registry nodes (including the one that ran setup) must run
  glance-registry
- this means we have a single role that is searchable