There's no way to grant roles on scopes

We have debusine-admin workspace grant_role|list_roles|revoke_role but we don't have debusine-admin scope grant_role|list_roles|revoke_role.

Even though the design supports having workspace owner role by the virtue of having scope owner role, we have no simple way to test that right now.