Filter LDAP dumb member when listing role assignments

When the LDAP assignment driver is used and the "use_dumb_member"
configuration option is enabled, the dumb member is listed when
listing the role assignments. This can be seen by running the live
LDAP tests, as the "test_list_role_assignments_unfiltered" test will
fail due to the additional role assignments for the dumb member.

This patch filters out the LDAP dumb member when listing role
assignments.

Change-Id: I585d54847778f02621b8201644ec9285495a63aa
Closes-Bug: 1280965
Make domain_id immutable by default

We already allow the domain_id in User, Group and Project entities
to be made immutable by use of a config option.  By default, however,
the domain_id is mutable.

This patch switches this so that the domain_id is immutable by default.
Although this changes existing functionality, it is felt that since
nearly all non-trivial production implementations that use domains
are going to want to restrict domain admin personas with a suitable
policy file, leaving the domain_id mutable by default represents a
potential vunerability that could be exploited.

Closes-Bug: 1294293

Change-Id: I0cb9fd4dc520d0a15bf54f4d138a3794d0ccd1d9
Comparisons should account for instantaneous test execution

The comparisons for the Revoke tests were greater than or less than, but if the test
did not take a full clock tick, the values could be equal.

Closes-Bug: 1295261

Change-Id: I7526640c283f13a4e4ed4f0b0ebd059bbe38ad9b
expires_at should be in a tuple not turned into one

Change-Id: I273ed2cd984f1e69cc595169a59647c76a8ca202
explicitly import gettext function

Change-Id: I2cdcbc82542c61a6d1aa9ba0d12f874589190001
Closes-Bug: 1294971
Merge "Comparisons should account for instantaneous test execution"
Merge "expires_at should be in a tuple not turned into one"
Merge "Filter LDAP dumb member when listing role assignments"
Merge "Make domain_id immutable by default"