Correct API for listing user roles & role assignments

The v3 API specification listed two api calls relating to roles that
are, in fact, un-implemented in the Grizzly code, namely:

GET /users/{user_id}/roles
GET /roles/{role_id}/users

These are replaced with a more generalized call for listing role
assignments, allowing for filtering based on domain, project, role,
user and group.

bp get-role-assignments
Fixes bug #1183430
Fixes bug #1183433

Change-Id: I8d3e61aab053f230fdc277f7847a58d834694ac4
Allow project roles to be inherited from their parent domain

Role assignments to a domain are already supported, in a similar way
to projects. However, in customer situations where administration of
role assigment is split between a cloud provider and individual domain
administrators, a cloud provider might want to be able to have roles
inherited from the domain (that they create) to the projects (that the
domain administrator creates).

This functionality is being provided as an extension, ahead of a more
integrated solution for IceHouse.

bp inherited-domain-roles

Change-Id: I8471b182337ae85600ac564795a2cc04fc85d1d5
Merge "Correct API for listing user roles & role assignments"