This commit updates the policies for adding and removing system
assignments from groups to be consistent with other system-scoped
policies.
Subsequent patches will build on this work and:
- add domain user test coverage
- add project user test coverage
- remove obsolete policies from policy.v3cloudsample.json
Change-Id: I90ecc67dbae60c74b69bb227a08205d4415bd16e
Related-Bug: 1805368
Related-Bug: 1750669
Related-Bug: 1806762
(cherry picked from commit ba09e89ba1)