In issue #195 @miguelgrinberg points out that we need a heat_stack_user
role which is assigned to keystone users created by stacks themselves.
This change adds that user and also moves some of the tasks in the
heat_domain_user role to heat_common, where they are better suited.
51f1a3aded