Cleanup mock identity service

This pull request cleans up the mock identity service we've been using for Auth-N and Auth-Z tests.

This pull request is required for B-60837 "Non-Tenanted AuthZ: Remove Tenant Comparison to URI for Users with a service-admin-roles", because it adds support for the get-roles identity call. However, the pull request is also useful on its own.

The original mock identity service was hackish, brittle, and difficult to follow or modify. The former way of simulating identity calls involved crude string tests, like startsWith, endsWith, and contains. These were potential bugs waiting to happen. The new way of doing things uses exact matches and regexes to avoid false positives. URL's that don't correspond to identity api calls --or which correspond to identity api calls that we haven't implemented yet-- will not accidentally be treated as, for example, a get-groups call.

The new system is also more modular. If we want to change the behavior of a single api call (e.g. validating a token), we can do so by changing a handler, without affecting any other parts of the api. Moreover, the clearer, more maintainable code also will make it easier to mock out additional api calls in the future.

All tests that previously relied on the IdentityServiceResponseSimulator class have been modified to use MockIdentityService.

I should probably put together some documentation to cover the way it works now. Also, at some point the other two slightly different identity response simulators, IdentityServiceRemoveTenantedValidationResponseSimulator and RackspaceIdentityServiceResponseSimulator, should be replaced with this updated way of doing things. However, both of those tasks can wait. For now, I need the current functionality to do the service-admin-roles tests.