keystone setup: refactor out of openstack-setup role

First service to be broken out of the openstack-setup roles. Avoids using keystone admin token for anything other than bootstrapping keystone. This is preparation for the Icehouse Neutron configuration for Nova notifications.