Predefine Nova admin role and policy

Current “admin” role in Nova and other services are pretty static. A
user with “admin” role has the super admin privilege not only in
Nova, but other services as well. In most organizations, compute
administrators and administrators from other services are from
distinct group of administrator. If an organization does not allow
Nova administrators to make changes to say Cinder or Neutron, then
Nova administrators should only have a “Nova specific admin role”,
and not the super ”admin” role.
Enhance Nova policy to include Nova admin role, so that
administrators with Nova admin role can perform Nova administrative
tasks without having to take on the super "admin" role.