Add scope_types to mapping policies
Add scope_types to mapping policies

The mapping API is intended to work with both `project` and `system`
scopes. It should be possible for system administrators to add
mappings for federation. It should also be possible for project or
domain administrators to add mappings for IdP authenticating to their
domain.

The scope types for managing mappings has been set to `system` until
that functionality is supported in keystone.

From now on, a warning will be logged when a project-scoped token is
used to manage federated mappings. Operators will have the ability to
require system-scoped tokens for these policies by enabling
oslo.policy's `enforce_scope` configuration option.

Change-Id: I6208ce23b77bb1db4896263369f6b2207b6e10ab

openstack/keystone,openstack/keystone,mahak/keystone,mahak/keystone,mahak/keystone,openstack/keystone