At present, when provisioning in a cluster, it blocks a long time
waiting for OpenStack to do what it needs to do.  This has a knock on
effect for UX in that said delay is visible in the UI and CLI tools.
This lays down the groundwork to make this asychronous so we don't hold
up uer interaction, but we do cluster provisioning.  This is a template
also for phyiscal network provisioning that takes even longer, and
causes request timeouts that need to be avoided.

This makes identity provisioning asynchronous and idempotent, which is
far more fault tolerant and can hide long provisioning times better at
the front end - the cost just disappears into cluster provisioning.  Two
very important things to note, first the openstack configuration should
live in a separate CR, second we've now got a problem in that the
kubernetes service needs to poll for provisioning, which cannot be done
without a token...

As previously commented, having openstack state in a controlled
resource is a bad idea. This separates stuff out so that a shadow record
is created to hold state, so the managed resource is not required to be
updated.