Policy sample - Identity v3 resources management

Adds the following rules to ``etc/policy.v3cloudsample.json``,
providing an operational Identity v3 API enabled setting:

* The cloud_admin can manage users in any domain.

* The cloud_admin can manage roles on any domain.

* Domain administrators can manage roles on any project in their own
  domain.

Change-Id: Id6ea8f469d5d05c04042c1395c4eae85b982bb25
Closes-Bug: #1267187
Merge "Policy sample - Identity v3 resources management"