Fix domain federation tokens for inherited roles.

Currently domain-scoped federation-generated tokens incorrectly
include group roles that are inherited to projects within that domain.
This error is also exposed via the /auth/domains and
/OS-FEDERATION/domains API calls. This patch fixes this.

Change-Id: I2b5c1e3d695dd7b27bf3b15361fccb5c13bdd554
Closes-bug: 1385533
Closes-bug: 1385643
Merge "Fix domain federation tokens for inherited roles."