Keystone: Implement RegisteredLimit Controller

[gndrmnn]

WIP

• No support for RegionID as k-orc does not have that resource currently
• RegisteredLimits are unnamed, but have a unique constraint over ResourceName, RegionID, and DefaultValue leading to some interesting challengens. E.g. Declaring two yaml files with two RegisteredLimits with the same RegionID and ResourceName will race to change the same entry.

[github-actions]

Failed to assess the semver bump. See logs for details.

[gndrmnn]

@mandre

Hi, this PR is more or less good to be reviewed. I am currently running into a strange problem though: In the registeredlimit-import test we are creating a mandatory Service to use in the import filter. In some cases, the CI pipeline will fail with Waiting for service/<service name> to be ready. Other times, it successfully proceeds to Waiting for OpenStack resource to be created externally. As you can see right now, two CI tests failed while the epoxy one passed.

I have already setup a local keystone instance to test this against, and I can not reproduce the Waiting for service/<service name> to be ready problem. So it looks like this is some kind of timing problem in the test maybe?

What makes this especially weird is, I have looked at the Endpoint actuator and used it as inspiration for this PR. The Endpoint also requires a mandatory ServiceRef and even declares it the same way as I do in the endpoint-import CI test. That test however does not flap at all. So I seem to be doing something wrong, I can not put my finger on right now.