Keystone v3 improvements.

Managers for project group membership, project user membership, project combined membership (users and groups); for group project membership, group users, group roles; for user project membership, user roles.
This needs to be implemented as a generic mechanism for handling the use of versions which are not published in the service catalog.

Let's do something like this in the openclient options:

    version_overrides: {
        identity: "v3"
     }

I personally don't like the model of using mixed/unpublished versions of APIs that aren't in the service catalog, but that's a fight that needs to happen upstream in openstack, so for now this is necessary.