Storage services need keystoneclient not keystone

The service recipes have been pulling in the entire
python-keystone package, which is the entire Keystone
set of services. This hasn't been necessary since
some time after Grizzly, when the tokenauth middleware
was moved to the client.

Change-Id: I6d326352ab5c8079cc5c405161475ec0354c5593
Related-Bug: #1305318
Allow packages to be updatable

In order for package updates to occur, package resources need to use
the upgrade action.

Change-Id: If155a53d87dfc6da52b55f181cde69595d956556
Implements: blueprint allow-package-updates