Implement project personas in custom keystone policy file
Implement project personas in custom keystone policy file

This change implements all project personas (project-admin,
project-member, and project-reader) where project-admins are technically
considered system-administrators using policy overrides.

This file was modified by generating the default sample policy file in
keystone:

  $ oslopolicy-sample-generator --namespace keystone

Then, working through the file to remove any system-specific checks
(e.g., role:admin and system_scope:all). After that, I used the
convert_policy_yaml_to_heat_template.py tool to update the existing
enable-secure-rbac.yaml file, resulting in a diff of the original
defaults, hopefully making it easier for reviews to see what exactly is
changing.

Change-Id: I3bddbb74dcaedf3f6c2f71ab826b2912b4bc7912

openstack/tripleo-heat-templates,openstack/tripleo-heat-templates