Scope access to Credentials by Project

A user cannot currently create a VM and inject anyone elses Key into it. In order to do so, Nova or horizon would need to expose a list of keypairs to the user and allow them to select which to inject. A user will explicitly associate one of their credentials with the project. then an API such as /v3/credentials?project_id would list the keypairs for that project (protected via RBAC).