keystone setup: refactor out of openstack-setup role

First service to be broken out of the openstack-setup roles. Avoids using keystone admin token for anything other than bootstrapping keystone. This is preparation for the Icehouse Neutron configuration for Nova notifications.
Having colons in this line, does it work in production plays without quoting the string?