Enable token scoping to a domain

This documents v3 api changes to allow a token to be scoped
do a domain as well as a project.  Now that keystone supports
RBAC on its own APIs along with domain level entities (like
users and groups), then it is appropriate to allow token
scoping to a domain to facilitate supporting roles like
Domain Administrators.

blueprint domain-scoping

Since they are so interrelated, this proposal also fixes
defect 1081681 (Unclear how domain_id is set for a user in v3 api).

DocImpact

Change-Id: Ica8594055f0a6bbb3fcda5a75a90eda45aac47d3