EC2 credential API doesn't use default roles

[Lance Bragstad]

In Rocky, keystone implemented support to ensure at least three default roles were available [0]. The EC2 credentials API doesn't incorporate these defaults into its default policies [1], but it should.

For example, system administrators should be able to clean up credentials regardless of users, but system members or readers should only be able to list or get credentials. Users who are not system users should only be able to manage their credentials.

[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html
[1] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/ec2_credential.py?id=6e3f1f6e46787ed4542609c935c13cb85e91d7fc

[Colleen Murphy (krinkle)]

https://review.opendev.org/607820

[Colleen Murphy (krinkle)]

Closed by https://review.opendev.org/607820