Grant admin role in heat domain to heat_domain_admin
This patch grants heat_domain_admin the admin role in the heat domain
(rather then in the service project).
We use :grant_domain instead of :grant_role, because we are setting a
role in a domain, not in a project.
Note that for the user to actually exist in the heat domain, a
sufficiently recent openstackclient cookbook is required -- otherwise
the domain_name attribute is ignored during user creation.
Also, we remove the user_name attribute (gets ignored by resource