Unable to attach ISO in child domain to an Instance

### problem

As of now a domain admin doesn't have access to the templates & ISOs created in it's child domains.
For example,
Assume in domain Root/D1, user u1 (Domain Admin)
Assume in domain Root/D1/D2, user u2

As of now, u1 cannot attach an ISO present in domain D1/D2 to an Instance in domain D1/D2.

### versions

_No response_

### The steps to reproduce the bug

1. Create Domains & Users like below
domain Root/D1, user u1 (Domain Admin)
domain Root/D1/D2, user u2
2. As u2, register an ISO (non-public) in D1/D2 and then launch an Instance in D1/D2.
4. As u1, I should be able to attach the registered ISO to the launched Instance in D1/D2.

### What to do about it?

As a Domain Admin, I should be able to attach an ISO to an Instance when both the ISO & the Instance are in child domains.

Root/D1/D2、ユーザー u1 と u2、非公開の ISO、D1/D2 内のインスタンスで階層を再現します。ISO をアタッチするときに使用される認可パスを追跡し、ドメイン管理者のアクセスと ISO およびインスタンスのドメインを比較します。u1 が、関連のないアクセス制御を弱めることなく、子ドメインの ISO を子ドメインのインスタンスにアタッチできれば完了です。

索引モデルが issue の本文から書いたものです。