Implement secure RBAC for records
Implement secure RBAC for records

This commit updates the policies for records to understand scope
checking and account for a read-only role. This is part of a broader
series of changes across OpenStack to provide a consistent RBAC
experience and improve security.

Change-Id: I093223790b699e35fb151e17111e34c24153d4c4

openstack/designate,openstack/designate,openstack/designate