Improve testing of domain federation tokens for inherited roles.

Currently domain-scoped federation-generated tokens incorrectly
include group roles that are inherited projects within that domain.
This error is also exposed via the /auth/domains and
/OS-FEDERATION/domains API calls.

This patch enhances our testing to demonstrate the error - a follow-on
patch will fix it.

Partially implements: bug 1385533
Partially implements: bug 1385643

Change-Id: I54d1d1a38cb63208c626efa5e4ca4a69e1b234a1
Merge "Improve testing of domain federation tokens for inherited roles."