domain-config: invalidate the identity resolved-driver cache on config API writes

[gtema]

Follow-up from #960 / #1202.

IdentityService caches the resolved per-domain identity driver in an in-memory
RwLock<HashMap<domain_id, driver_name>> with no invalidation. A change to a
domain's identity/driver through the domain config API
(PUT/PATCH/DELETE /v3/domains/{id}/config) is not observed until the process
restarts.

Wanted

• Invalidate (or refresh) the cache entry for a domain when its stored
  configuration changes via the config API.
• Options: a notification/event from DomainConfigService to IdentityService,
  a shared versioned handle, or dropping the cache in favour of the request
  cache with a short TTL. python-keystone reloads domain config drivers on a
  timer + on domain_config events.
• Multi-node: an API write on one node must invalidate peers (event bus / raft
  notification), or document that per-node staleness is acceptable between
  restarts.