add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
> Why does this have to be a strong coupling to identity the struct vs UserInfo the interface?

@smarterclayton @liggitt It's not that the transformation couldn't be done.  It felt odd to return an object that wasn't compatible with the API to persist the mapping since either persisting or retrieving the identity mapping will always be the next step for our code.  The code in external/handler.go became: get UserInfo, transform UserInfo to Identity, persist Identity and get IdentityMapping result, transform IdentityMapping back into UserInfo, make succeeding call.  It felt like a copy and paste from another project.  My personal preference is to have a single type to represent an entity across the product to make tracking usage easier as opposed to having different representations entities for each component and adapters between them all.  I would argue that our oauth/external package will always have a need to contact the persistence for storage and retrieval, so the coupling is going to present in the package regardless.  Convinced or should I change GetUserIdentity back and adapt the value in handler.go?