Unable to attach ISO in child domain to an Instance

### problem

As of now a domain admin doesn't have access to the templates & ISOs created in it's child domains.
For example,
Assume in domain Root/D1, user u1 (Domain Admin)
Assume in domain Root/D1/D2, user u2

As of now, u1 cannot attach an ISO present in domain D1/D2 to an Instance in domain D1/D2.

### versions

_No response_

### The steps to reproduce the bug

1. Create Domains & Users like below
domain Root/D1, user u1 (Domain Admin)
domain Root/D1/D2, user u2
2. As u2, register an ISO (non-public) in D1/D2 and then launch an Instance in D1/D2.
4. As u1, I should be able to attach the registered ISO to the launched Instance in D1/D2.

### What to do about it?

As a Domain Admin, I should be able to attach an ISO to an Instance when both the ISO & the Instance are in child domains.

Reproduce the hierarchy with Root/D1/D2, users u1 and u2, a non-public ISO, and an instance in D1/D2. Trace the authorization path used when attaching an ISO and compare domain-admin access with the ISO and instance domains; done means u1 can attach the child-domain ISO to the child-domain instance without weakening unrelated access controls.

Written by the indexing model from the issue text.