Hide form tooltip when form closes on escape key

Fixes #1215277

Form tooltips used in every form.
After form closes on escape button tooltip stays on screen
until the page is refreshed.
This fix listen escape key pressing and close opened tooltip.

Change-Id: Ie01336787a3bd11ed967e085ee7dda4616441cc7
Implement assignment of Domain Roles to Group

Added Domain Groups step in the Domain Update workflow for managing
domain-role assignment to Groups.

Change-Id: I882f9213ab8d72032d542dc45558e9479a86741e
Implements: blueprint group-domain-role-assignment
Adding RBAC policy system and checks for identity

Adding file based RBAC engine for Horizon using copies of nova and
keystone policy.json files

Policy engine builds on top of oslo incubator policy.py, fileutils
was also pulled from oslo incubator as a dependency of policy.py

When Horizon runs and a policy check is made, a path and mapping of
services to policy files is used to load the rules into the policy
engine.  Each check is mapped to a service type and validated.  This
extra level of mapping is required because the policy.json files
may each contain a 'default' rule or unqualified (no service name
include) rule.  Additionally, maintaining separate policy.json
files per service will allow easier syncing with the service
projects.

The engine allows for compound 'and' checks at this time.  E.g.,
the way the Create User action is written, multiple APIs are
called to read data (roles, projects) and more are required to
update data (grants, user).

Other workflows e.g., Edit Project,  should have separate save
actions per step as they are unrelated.  Only the applicable
policy checks to that step were added.  The separating unrelated
steps saves will should be future work.

The underlying engine supports more rule types that are used in the
underlying policy.json files.

Policy checks were added for all actions on tables in the Identity
Panel only.  And the service policy files imported are limited in
this commit to reduce scope of the change.

Additionally, changes were made to the base action class to add
support or setting policy rules and an overridable method for
determining the policy check target. This reduces the need for
redundant code in each action policy check.

Note, the benefit Horizon has is that the underlying APIs will
correct us if we get it wrong, so if a policy file is not found for
a particular service, permission is assumed and the actual API call
to the service will fail if the action isn't authorized for that user.

Finally, adding documentation regarding policy enforcement.

Implements: blueprint rbac

Change-Id: I4a4a71163186b973229a0461b165c16936bc10e5
Fix the Domain context for Projects panel

Add display of Domain ID and Domain Name in the Create and Update
Projects page to give user a hint where the Project will be created.
For Keystone V2, the two fields will be hidden.

When the Domain Context is set, the Project will be created in that
Domain Context. Otherwise, the Project will be created in the Domain
of the logon user.

On project creation, the listing of available users and groups will
be based on the Domain where it will be created. While on project
update, the listing of available users and groups will be based on
the Domain of the Project.

Fixes bug 1215196

Change-Id: Ia2ab25956621d01c2173e08402241b7f60401e0f
Merge "Implement assignment of Domain Roles to Group"
Merge "Fix the Domain context for Projects panel"
Merge "Adding RBAC policy system and checks for identity"
Merge "Hide form tooltip when form closes on escape key"