Document Keystone2Keystone federation

Document the following:
  - create a region
  - setup config options
  - run keystone-manage command for metadata
  - samlize the token

Change-Id: I771fc5bbe1bb57f36bfbc929f2c64d17c2641899
Change pysaml2 comment in test-requrements.txt.

    Even though the ``pysaml2`` library is used for Keystone2Keystone
    functionalities, Keystone will complain about missing dependency right
    after federation extension is enabled.
    Commend in the test-requirements.txt should be updated to reflect the
    situation.

Change-Id: Id4e615905574d5ad3d050bd8077b25f8327419ab
Revoke the tokens of group members when a group role is revoked

Fixes a bug introduced by the previous commit:
https://review.openstack.org/#/c/115338/

If revoke_api is not enabled, tokens of group members are not revoked
when a group role is revoked.

Change-Id: I7542ee775ddd6fd240ecb370a3e243e465accbb0
Closes-Bug: 1369664
Adds a whitelist for endpoint catalog substitution

Change-Id: If02327d70d0143d805969fe927898f08eb84c4c2
Closes-Bug: #1354208
Merge "Change pysaml2 comment in test-requrements.txt."
Merge "Revoke the tokens of group members when a group role is revoked"
Merge "Adds a whitelist for endpoint catalog substitution"