Fix Jenkins builds by correctly restricting builder permissions

* When using broker auth on a REST API call, a "ci_server" app will get a DomainBuilder scope which allows the app to create a builder application that is linked to the creating application.  
 * When membership_enabled is true the domain builder only has access to change applications that it created
 * If the app isn't ci_server, it only gets the scale scope
* Fix a bug that prevent domain ssh key propagation
* Allow scopes to limit ids and queries at the same time
* Switch broker auth keys to being generated using the id, and continue to support the old way.