add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
Don't do this - we avoid making our DTOs have methods specifically to force decoupling of concerns.  The provider package should be passing an internal struct (all the values it supports retrieving) to an interface which persists that object as userapi.UserIdentityMapping.  That prevents oauth from being coupled to our user implementation.