Add roles for existing use cases

References: #395 (closed), #487 (closed), permission design blueprint.

This ticket tracks the initial introduction of roles to model permission checks currently existing in Debusine, that is, public and private workspaces.

Likely next steps:

• Create in the code an initial set of roles for Workspace
• Create a role table to assign Group roles for Workspace

(report time in #395 (closed))