Only attempt keystone's db_sync on ocdb node(s)

ha. I knew this would wind up getting added eventually :) I wasn't so sure what the priority should be between role vs. env. Any reason you decided to put it in this order?