Support membership and RBAC in OpenShift

* Implement a membership model for OpenShift that allows an efficient query of user access based on each resource. 
* Implement scope limitations that correspond to specific permissions 
* Expose membership info via the REST API (disableable via config) 
* Allow multiple domains per user, controlled via a configuration flag 
* Support additional information per domain (application_count and gear_counts) to improve usability 
* Let domains support the allowed_gear_sizes option, which limits the gear sizes available to apps in that domain 
* Simplify domain update interactions - redundant validation removed, and behavior of responses differs slightly. 
* Implement migration script to enable data