Specify target of a domain role grant

When a user or group domain role grant is made, the current api
specification states that this should be treated as applying the
role to all enclosed projects.  This change re-defines the meaning
of a domain grant to be a grant on the container itself, so that
role such as Domain Administrator (e.g. maintain users for a
specific domain) can be implemented.

If in the future there is a strong use case for an "apply a role to
a collection of projects", then we will consider this with something
like:

PUT /roles/{role_id}/users/{user_id}/projects?domain_id={domain_id}

Blueprint domain-role-assignment

DocImpact

Change-Id: If7d90902cc09c749b2e0793063b3d113347569d5
Update examples: facing->interface (bug 1091413)

Also removed references to the 'extra' attribute, as non-indexed
attributes are intended to be included with the entity response itself
just as they were POST'ed, not rendered back to the client as a text
blob.

Change-Id: Id799faff3bea6076ca5ff74a61c33b5749b3a7ee
Merge "Specify target of a domain role grant"