Make property protection tests use member role
Make property protection tests use member role

In order to avoid overriding the default policy in tests to be
completely unrestricted (as they are today), the property protection
tests need to add the member role into the roles being used to
test the additional permissions. This is because the actual default
policies require "admin or project member" permissions to do anything,
and just using one of the special roles will get blocked by the
regular policy before property protections are checked.

This could also be fixed by constructing a very complex policy for
these tests which allows those special roles to do their thing in
addition to member, but I do not believe this is how real deployments
would actually implement it.

These should definitely be reviewed with scrutiny to make sure that
all the assertions are still valid, and make sure we don't need more
than are already here.

Note that there are a couple assertions that were looking for CONFLICT
instead of FORBIDDEN on the special role attempt, that seems to be
a case of "test the current behavior not the desired one".

Change-Id: Ib6540223468421776f07745010e5d4afe5d58774

openstack/glance,openstack/glance,openstack/glance