Ensure v3policysample correctly limits domain_admin access

Recent changes tidied up the v3 sample policy, but unfortunately this
introduced a defect that meant a domain admin could create roles on
other domains.  In addition, in an attempt to simplify the policies,
these changes increased the risk of a user being able to spoof the
policy by using bogus url options. This patch fixes these issues.

Limitations:
- The current code + policy does not prevent a domain admin updating the
  domain_id of a user/group/project to some other domain.  Ideally we
  would prevent this via policy, but this requires an enhancement
  to our policy engine (to be be able to check for existance of a member
  in an object).  Such a change of domain_id is, with this patch, at
  least now benign - since if the user acting as domain admin does not
  have a role on the new domain, then there is nothing they can do. A
  separate bug (1291393) has been raised for this.

Closes-Bug: 1287219

Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5