Keystone policy.v3cloudsample.json doesn't allow proper resources management

[Florent Flament]

When using the current `̀ etc/policy.v3cloudsample.json`` file as
Keystone's ``/etc/keystone/policy.json`` file (with `̀
admin_domain_id`` properly configured), the following issues arise:

* The cloud_admin user cannot manage users in other domains that the `̀
  cloud`` domain. For instance, once the cloud_admin created a brand
  new domain, he cannot create a user in this domain.

* The cloud_admin cannot manage roles on other domains that the `̀
  cloud`̀ domain. For instance, if the cloud_admin managed to create a
  domain and a user in this new domain, he cannot grant the `admin`
  role on the domain to this new user.

* A domain administrator (user with the ``admin`` role on the domain)
  cannot manage roles on projects in its own domain. For instance, a
  domain administrator can create a project and a user in his domain,
  but he cannot grant the Member role on the project to the new user.

With the following additional rules, one would have an operational
Identity v3 API enabled setting:

* The cloud_admin should be allowed to manage users in any domain.

* The cloud_admin should be allowed to manage roles on any domain.

* Domain administrators should be allowed to manage roles on any
  project in their own domain.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/65510

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/65510
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=0496466821c1ff6e7d4209233b6c671f88aadc50
Submitter: Jenkins
Branch: master

commit 0496466821c1ff6e7d4209233b6c671f88aadc50
Author: Florent Flament <email address hidden>
Date: Wed Jan 8 18:36:51 2014 +0100

    Policy sample - Identity v3 resources management

    Adds the following rules to ``etc/policy.v3cloudsample.json``,
    providing an operational Identity v3 API enabled setting:

    * The cloud_admin can manage users in any domain.

    * The cloud_admin can manage roles on any domain.

    * Domain administrators can manage roles on any project in their own
      domain.

    Change-Id: Id6ea8f469d5d05c04042c1395c4eae85b982bb25
    Closes-Bug: #1267187