Improve testing of project federation tokens for inherited roles.

Currently project-scoped federation-generated tokens fail to include
group roles that are inherited to the project from the owning domain.
This error is also exposed via the /auth/projects and
/OS-FEDERATION/projects API calls.

This patch enhances our testing to demonstrate the error - a follow-on
patch will fix it.

Partially implements: bug 1389752

Change-Id: I359de7f0e331e7bb5786ab892885b57954b8e442
Merge "Improve testing of project federation tokens for inherited roles."