Clarify doc on kwarg 'roles' for user_present().

Previously passing the roles in single-key-dicts
worked so the changed behavior should be reflected
in a updated docstring.

salt/states/keystone.py

@@ -102,7 +102,16 @@ def user_present(name,
         Availability state for this user
 
     roles
-        The roles the user should have under tenants
+        The roles the user should have under given tenants.
+        Passed as a dictionary mapping tenant names to a list
+        of roles in this tenant, i.e.::
+
+            roles:
+                admin:   # tenant
+                  - admin  # role
+                service:
+                  - admin
+                  - Member
     '''
     ret = {'name': name,
            'changes': {},