Add identity mapping capability

This adds the underlying capability of identity mapping that will be
needed for multi-backend unified identifiers. The mapping capability
is not yet wired into the rest of Keystone - a subsequent patch will
modify identity core and supporting files to do this.

In order for this patch to be totally invisible, the addition of
relevant config options, as well as documentation, is left to the
follow-on patch when this capability is exposed to cloud providers.

Partially Implements Blueprint: multi-backend-uuids

Change-Id: Idfcad2ef30195f7b7a25dfff52fc1498fc3fa9f1
Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
Closes-Bug: #1331912
Ending periods in exception messages deleted

Some of messages contained a period at the end of line right after key
content. This created bad user experience while copying from the
terminal because this period was usually copied too.

Change-Id: If9a74f865f0813469f215bc6b4dd8a934fbf8f44
Closes-Bug: #1313837
Merge "Ensure that in v2 auth tenant_id matches trust"
Merge "Ending periods in exception messages deleted"