add freeipa-security-domains design doc