Use class attribute to represent 'user' and 'group'

When sending a notification a resource_type is required, such as a user
or project. This value is always consistent between the different
notifications.created, updated, deleted methods, so make it a class
attribute.

Change-Id: I084fedb1d8f0c1b1d7db575860d96ff2e5a27647
Update sample config

The sample config file was out of date, generated with

 $ tox -r -e sample_config

Change-Id: I51e0b35f21fc27edb8376310214d79afcb40cd77
Do not use keystone.conf.sample in tests

The keystone.conf.sample file has no values set in it (anymore)
and therefore should not be loaded by the test cases. The one
exception to this rule is the ConfigTestCase as the config file
is used in one of the code paths to determine paste-ini location.

Change-Id: I6b9dbe160c5ffe26971320a29f933018ac0486c2
Merge "Update sample config"
Ensure v3policysample correctly limits domain_admin access

Recent changes tidied up the v3 sample policy, but unfortunately this
introduced a defect that meant a domain admin could create roles on
other domains.  In addition, in an attempt to simplify the policies,
these changes increased the risk of a user being able to spoof the
policy by using bogus url options. This patch fixes these issues.

Limitations:
- The current code + policy does not prevent a domain admin updating the
  domain_id of a user/group/project to some other domain.  Ideally we
  would prevent this via policy, but this requires an enhancement
  to our policy engine (to be be able to check for existance of a member
  in an object).  Such a change of domain_id is, with this patch, at
  least now benign - since if the user acting as domain admin does not
  have a role on the new domain, then there is nothing they can do. A
  separate bug (1291393) has been raised for this.

Closes-Bug: 1287219

Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5
Merge "Do not use keystone.conf.sample in tests"
Merge "Use class attribute to represent 'user' and 'group'"