Fix project federation tokens for inherited roles.

Currently project-scoped federation-generated tokens fail to include
group roles that are inherited to the project from the owning domain.
This error is also exposed via the /auth/projects and
/OS-FEDERATION/projects API calls. This patch patch fixes this.

Change-Id: I1ce5007984938365208630ad901c7c508c57fcd4
Closes-bug: 1389752
Closes-bug: 1385694
Merge "Fix project federation tokens for inherited roles."