Mint auth interface into the JWT token

[gtema]

Future steps of authn/authz rework assume keystone will only issue unscoped jwt tokens. This present problem with guarding the access where now keystone-rs is able to guard admin access to admin i/f, but unscoped jwt sent to nova doesn't have this info anymore. To address this put the i/f name the initial auth request came in into the jwt:

{
  "sub": "user:ops-alice",
  "iss": "https://keystone.internal:8444/v4/oauth2/system",
  "aud": "openstack-admin-api",
  "amr": ["hwk", "tpm"],
  "openstack": {
    "system_scope": "all",
    "roles": ["admin"],
    "issuance_channel": "admin_uds"
  }
}