Upload metadata for federation

When keystone acts a service provider it accepts assertions from potentially multiple different identity providers. In the case of a public cloud, that must be restricted in a tenantized manner - giving each customer authority of their own IdP definition whose assertions are restricted to the domain(s) the customer may access.

As is, the current method to setup an IdP requires the keystone administrator to update an apache config.
This method isn't sustainable for large cloud operators with many customers.

This blueprint is to enable the upload of the SAML metadata, used to describe the identity provider, into keystone (acting as the service provider).