trust creation allowed with empty roles list

The docs state "A project_id may not be specified without at least
one role, and vice versa.", however /OS-TRUST/trusts does allow you
to create a trust with an empty roles list and project_id specified.

This results in 401 responses whenever you try to consume the trust,
because there are no roles for the trustee on the authorized project.

This patch will add a check in trust creation to ensure at least one
role exists if project_id is supplied.

Change-Id: Iebad0b6b7ed62a029d1e50afb003679bafb1655d
Closes-Bug: #1214064
Provide option to make domain_id immutable

Currently, a user, group or project entity can be moved between
domains by updating their domain_id. There are situations where
this is not desirable (and in fact could create a potential security
hole) - for example when creating a domain admin persona, using an
appropriate policy file (such as policy.v3cloudsample).

For backward compatibility, the option to make the domain_id immutable
is controlled by a config option, with the default being no change
to existing functionality.

Change-Id: Idd847f471beae7387d6cc59af0a960a923da799f
Closes-Bug: 1291393
Merge "trust creation allowed with empty roles list"
Merge "Provide option to make domain_id immutable"