introduce new cliff-based multi-command model

This replaces the old "crux" script with a cliff-based tool supporting
multiple subcommands.  In addition to manipulating users/tenants/roles,
crux is now able to handle keystone services and endpoints.