keystone_user_role fix for when user not granted roles yet

Fix situation where keystone_user_role resource fails if the
user is not already granted at least one role on the tenant.

Change-Id: I95e3e0aac784d0bc70f0c8a8db2cc13d74a174ea
Closes-Bug: 1381725
Add keystone::resource::service_identity

service_identity resource is a library resource that can
be used by puppet-keystone,nova,cinder,ceilometer,etc., rather than replicating
equivalent functionality across all of these modules to manage Keystone
resources like user, tenant, service, and endpoints.

This patch does:
* add keystone::resource::service_identity + unit tests
* use the function in keystone::endpoint

Implements: blueprint common-openstack-identity-resource

Change-Id: I0afe66f54d320ee29cf596a1844ea0ff7d384d6b
Merge "keystone_user_role fix for when user not granted roles yet"
Merge "Add keystone::resource::service_identity"