Implement project personas in custom nova policy file
Implement project personas in custom nova policy file

This commit updates the default nova policies in enable-secure-rbac.yaml
to implement consistent project personas (project-admin, project-member,
and project-reader) with other OpenStack services. The project-admin is
still considered a system administrator, even though the default
policies in nova upstream use system scope.

This behavior will change in future releases when more OpenStack
services adopt system scope, which is a Yoga community goal. At that
time, we can drop custom policy overrides all together and get
consistent behavior with the defaults upstream.

Change-Id: Ia6681703a9ca000b2fa712ee3a9906f05909d24a

openstack/tripleo-heat-templates,openstack/tripleo-heat-templates