openstack: say when a Keystone cannot redeem application credentials at all

[traviswu-bigstack]

What

When Keystone refuses because it does not enable the application_credential
auth method at all, say that, and say which methods it does offer. An ordinary
401 keeps its existing wording.

Why

Found by the ADR 0011 lab validation, on a real CubeCOS cluster. An
application credential that existed, was scoped to the right project and had
not been revoked could not be redeemed:

HTTP 401
{"error":{"code":401,"identity":{"methods":["password","token","oauth1","mapped"]},
 "message":"Attempted to authenticate with an unsupported method.","title":"Unauthorized"}}

/etc/keystone/keystone.conf on that cluster:

[auth]
methods = password,token,oauth1,mapped

application_credential is absent. Upstream Keystone enables it by default;
CubeCOS has narrowed the list. So an application credential can be created
there — the API allows it, and openstack application credential create
succeeds — and never redeemed.

The message this replaces named the one thing that was not wrong:

Keystone refused the application credential (HTTP 401); check that it exists
and has not been revoked

That sends the reader to inspect a healthy credential. The two conditions have
different owners — a revoked credential is the operator's to reissue, a missing
auth method is the platform's to enable — and an operator reading a log needs
to know which one they are looking at.

Reviewer notes

Only error.identity.methods is read. Never error.message, never the body:
a Keystone error can echo the request, and the request holds the secret. The
existing TestAKeystoneRefusalNeverQuotesTheSecret still passes, and the new
test asserts the secret is absent from the new branch's message too.

TestAnOrdinaryKeystoneRefusalStillBlamesTheCredential pins the other
direction — a revoked or mistyped credential is still the common case, and
that test fails if this branch swallows it.

Proved failable: disabling the new branch fails
TestAKeystoneThatCannotRedeemApplicationCredentialsSaysSo on all three of its
assertions; restored, the full suite is green (GO_TEST_RC=0, zero --- FAIL:
lines).

This improves the diagnosis, it does not make creates work on CubeCOS.
Whether the product should enable application_credential, or whether the
agent should authenticate some other way, is a design question this PR
deliberately does not answer — it is recorded in the lab validation runbook.

Docs

Lab validation runbook in the handbook records the finding, the evidence and
the open question.