Specify target of a domain role grant

When a user or group domain role grant is made, the current api
specification states that this should be treated as applying the
role to all enclosed projects.  This change re-defines the meaning
of a domain grant to be a grant on the container itself, so that
role such as Domain Administrator (e.g. maintain users for a
specific domain) can be implemented.

If in the future there is a strong use case for an "apply a role to
a collection of projects", then we will consider this with something
like:

PUT /roles/{role_id}/users/{user_id}/projects?domain_id={domain_id}

Blueprint domain-role-assignment

DocImpact

Change-Id: If7d90902cc09c749b2e0793063b3d113347569d5
Merge "Specify target of a domain role grant"