keystone setup: refactor out of openstack-setup role

First service to be broken out of the openstack-setup roles. Avoids using keystone admin token for anything other than bootstrapping keystone. This is preparation for the Icehouse Neutron configuration for Nova notifications.
Just pulled down updated upstream keystone_service module: https://github.com/openstack-ansible/openstack-ansible-modules/blob/master/keystone_service