Configure Heat's metadata, waitcondition and cloudwatch server

Those urls were wrong in 100% of the cases. use the publicURL
of the corresponding Heat services instead.
Create Keystone role for Heat Stacks

The Heat CFN managed servers use a separate keystone
role that needs to be created before it can be used.