This change adds access_rules as a parameter for creating application
credentials, and also adds the ability to list access rules and to
retrieve and delete individual rules. Directly creating an access rule
or updating one is not supported.

bp whitelist-extension-for-app-creds

Depends-On: https://review.opendev.org/671374
Change-Id: I490f1e6b421d4f36f588f83a511ce39b9b4204e2

Thsi commit adds client support for managing limits in keystone.

bp unified-limits

Change-Id: I33251dbd4d3bfaf178ca86a2f5d564ac94879dd2

This change add client support for creating, reading, updating, and
deleting registered limits.

A subsequent patch will do the same for project-specific limits.

bp unified-limits
Depends-On: https://review.openstack.org/#/c/569741/
Change-Id: I6b5d106d08af53c2ad41ed3f799e9e71d370c6dd

Add support for creating, reading, and deleting application credentials.
Application credentials do not support updating.

Keystoneclient does not handle authentication with application
credentials. This is done in keystoneauth. Additional work will be
needed in python-openstackclient to support both CRUD and auth for
application credentials.

bp application credentials

Change-Id: I21214238deac2c45f2f2d666287c2ae106955ab1

The following API calls are made available:

- POST /OS-EP-FILTER/endpoint_groups
- GET /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
- HEAD /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
- PATCH /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
- DELETE /OS-EP-FILTER/endpoint_groups/{endpoint_group_id}
- GET /OS-EP-FILTER/endpoint_groups

Partial-Bug: #1641674

Change-Id: I285eefe82152b178268f671e8800a0ff8c1511e4

- At least one API was not implemented (list_implied_roles)
- the tests were lacking assertions and proper mocked responses
- some of the functionality just didn't work (see bug)
- returning Role objects instead of InferenceRule objects

Related commits:
 - I80a40e88b571fe9b0eca3af8b705ea79f28eb904
 - I66e863fb83f8dfcca2c48116d4377df060f402c3

Closes-Bug: 1647934
Change-Id: I7b449a93d7d4d3eb9ca857f6c1f78f884bad2534

Provide support for the domain-specific configuration storage available
via the REST API.

Domain configs are JSON blobs and we have fine grained control on them
via the Identity API. This fine grained control is not defined yet in the
client, though - for now, we can manage everything like Python dictionaries
and use operations like "update" whenever we want to delete a specific group
or option. This approach is similar to what is done in the federation mapping
API to handle mapping rules.

Functional tests are also included, this is useful to check if the new
feature works in an integration environment.

Co-Auhtored-By: Henry Nash <henryn@linux.vnet.ibm.com>
Co-Authored-By: Rodrigo Duarte <rduartes@redhat.com>

Closes-Bug: 1433306

Partially Implements: blueprint domain-config-ext

Change-Id: Ie6795b8633fed38c58b79250c11c9a045b7f95a4

Currently tox ignores D204, D205, and D207.
D204: 1 blank required after class docstring.
D205: Blank line required between one-line summary and description.
D207: Docstring is under-indented.
This change removes  D204, D205, and D207 ignores in tox and fix violations.

Change-Id: Id20d216fbd7647d468859b960088aac61c582d9b

Currently tox ignores D301.
D301: Use r”“” if any backslashes in adocstring.
This change removes D301 ignore and fix violations.

Change-Id: I9dbe2c9d59e2c2d8585a53840a579a9b9c57a09c