Unable to attach ISO in child domain to an Instance

### problem

As of now a domain admin doesn't have access to the templates & ISOs created in it's child domains.
For example,
Assume in domain Root/D1, user u1 (Domain Admin)
Assume in domain Root/D1/D2, user u2

As of now, u1 cannot attach an ISO present in domain D1/D2 to an Instance in domain D1/D2.

### versions

_No response_

### The steps to reproduce the bug

1. Create Domains & Users like below
domain Root/D1, user u1 (Domain Admin)
domain Root/D1/D2, user u2
2. As u2, register an ISO (non-public) in D1/D2 and then launch an Instance in D1/D2.
4. As u1, I should be able to attach the registered ISO to the launched Instance in D1/D2.

### What to do about it?

As a Domain Admin, I should be able to attach an ISO to an Instance when both the ISO & the Instance are in child domains.

使用 Root/D1/D2、使用者 u1 和 u2、一個非公開 ISO，以及 D1/D2 中的一個執行個體重現此階層。追蹤附加 ISO 時使用的授權路徑，並比較網域管理員的存取權與 ISO 和執行個體所屬的網域；當 u1 能夠將子網域的 ISO 附加至子網域的執行個體，同時不削弱無關的存取控制時，即表示完成。

由索引模型根據 Issue 內容生成。