Improve testing of domain federation tokens for inherited roles.
Improve testing of domain federation tokens for inherited roles.

Currently domain-scoped federation-generated tokens incorrectly
include group roles that are inherited projects within that domain.
This error is also exposed via the /auth/domains and
/OS-FEDERATION/domains API calls.

This patch enhances our testing to demonstrate the error - a follow-on
patch will fix it.

Partially implements: bug 1385533
Partially implements: bug 1385643

Change-Id: I54d1d1a38cb63208c626efa5e4ca4a69e1b234a1

ilay09/keystone,cernops/keystone,dstanek/keystone,jamielennox/keystone,ajayaa/keystone,openstack/keystone,jumpstarter-io/keystone,blueboxgroup/keystone,jamielennox/keystone,mahak/keystone,cernops/keystone,dstanek/keystone,roopali8/keystone,nuxeh/keystone,vivekdhayaal/keystone,maestro-hybrid-cloud/keystone,klmitch/keystone,jonnary/keystone,blueboxgroup/keystone,promptworks/keystone,promptworks/keystone,mahak/keystone,promptworks/keystone,himanshu-setia/keystone,MaheshIBM/keystone,nuxeh/keystone,MaheshIBM/keystone,takeshineshiro/keystone,dstanek/keystone,vivekdhayaal/keystone,maestro-hybrid-cloud/keystone,openstack/keystone,rajalokan/keystone,roopali8/keystone,mahak/keystone,rushiagr/keystone,idjaw/keystone,dims/keystone,dims/keystone,takeshineshiro/keystone,jumpstarter-io/keystone,nuxeh/keystone,rushiagr/keystone,idjaw/keystone,UTSA-ICS/keystone-kerberos,ilay09/keystone,ilay09/keystone,vivekdhayaal/keystone,UTSA-ICS/keystone-kerberos,klmitch/keystone,jumpstarter-io/keystone,rushiagr/keystone,jonnary/keystone,himanshu-setia/keystone,rajalokan/keystone,ajayaa/keystone,openstack/keystone,rajalokan/keystone