Add documentation explaining the Identity "personas" supported
by Cinder and a permissions matrix showing the intended permissions
these personas have with respect to the cinder policy targets.
Also mark policies that need to be deprecated because they're not
fine-grained enough, and introduce new policies to replace them.
Change-Id: Id5ea2c81bedf51f3e0b4c5cb4ef569f255143a9e