Improve testing of project federation tokens for inherited roles.
Improve testing of project federation tokens for inherited roles.

Currently project-scoped federation-generated tokens fail to include
group roles that are inherited to the project from the owning domain.
This error is also exposed via the /auth/projects and
/OS-FEDERATION/projects API calls.

This patch enhances our testing to demonstrate the error - a follow-on
patch will fix it.

Partially implements: bug 1389752

(cherry picked from commit 7327e937fd7102879536d5ea3bd17349e2e184ed)

Change-Id: I359de7f0e331e7bb5786ab892885b57954b8e442

ging/keystone,ging/keystone