Global roles propagated to tenants

[byewokko]

closes #357

Summary

• Introduce global roles that can be assigned within each tenant individually.

Compatibility

• Works with older Seacat Admin WebUI versions without the new features.
• Full UI support for the new features introduced here: http://gitlab.teskalabs.int/ateska/webui-microfrontends-poc/-/merge_requests/354

Propagated global roles

• Propagated global roles are global roles created with attribute propagated=true.
• They are propagated into all tenants and can be assigned and unassigned in each tenant independently.
• The propagated roles look like regular tenant roles, apart from having a ~ after the slash in their ID. E.g. a global role called */reader is propagated as mytenant/~reader, yourtenant/~reader etc.
• Modifying these roles requires superuser privileges (as with regular global roles). The propagated flag is not editable after role creation. Changes to the global role propagate immediately to its propagated tenant roles.
• Modifying the propagated tenant roles is not possible.

Tech details

• Role service uses three types of RoleView class - global, global propagated and tenant - for listing, searching and getting the three different types of roles.
• Introduced SessionContext, a context variable that holds the auth session of the request.

[ateska]

Remark to naming, otherwise mergeable.