Fix typo in identity:list_role_assignments policy

Change-Id: I3c154b8e16f6e45a13a5045062e68b4d9f475211
Signed-off-by: Paul Belanger <paul.belanger@polybeacon.com>
Uses oslo's deprecated decorator; removes ours

bp: deprecated-as-of-icehouse
Change-Id: Ideeaca14ccd8cbf7c37b096338324b5bc0e021d6
Merge "Fix typo in identity:list_role_assignments policy"
trustee unable to perform role based operations on trust

There was a typo in a conditional that checked the trustor twice, instead
of trustee and trustor. The typo was preventing a trustee from being
able to list or get or check roles that were delegated.

Also, removed the spurious check of is_admin from said conditional
(_is_trustor_trustee_admin), and renamed it to _is_trustor_trustee.

An additional check, to see if a trust existed, was removed since it
was repeated unnecessarily.

Added a test to cover the gap that was discovered in the bug report.

SecurityImpact

Change-Id: Id61e71cb3ea7c6bc51783af067fbbbe4c9bffafe
Closes-Bug: 1261104
Policy based domain isolation can't be defined.

Policy based domain isolation is not possible on token
APIs due to lack of domain_id in policy_dict for API target

Closes-Bug: 1233874
Closes-Bug: 1251048

Change-Id: I855ec8ff4899ba3797a2e2bb23945ab4b23d2bea
Merge "Uses oslo's deprecated decorator; removes ours"
Merge "Policy based domain isolation can't be defined."
Merge "trustee unable to perform role based operations on trust"