Add identity mapping capability

This adds the underlying capability of identity mapping that will be
needed for multi-backend unified identifiers. The mapping capability
is not yet wired into the rest of Keystone - a subsequent patch will
modify identity core and supporting files to do this.

In order for this patch to be totally invisible, the addition of
relevant config options, as well as documentation, is left to the
follow-on patch when this capability is exposed to cloud providers.

Partially Implements Blueprint: multi-backend-uuids

Change-Id: Idfcad2ef30195f7b7a25dfff52fc1498fc3fa9f1