Idempotency for keystone initialization

This review applies some fixes needed for Keystone/LDAP integration.
Generally, when Keystone uses LDAP as backend, users are expected to be
pre-configured in LDAP. Calling user-create when keystone is connected
to LDAP will cause error, so all user-create operations must be called
only if user does not exist yet. Other initialization steps like
user/role mappings still should be called in this case, so user
existence check should not be used to determine if operation is needed.

Idempotency was already added for admin user in os-cloud-config with
with https://review.openstack.org/100719.

Change-Id: I154c3b07bbd6523eb9977e8ce3755fcbf561cc7f
Merge "Idempotency for keystone initialization"