Create initial set of roles for Scope

References: #395 (closed), #487 (closed), permission design blueprint.

This ticket tracks the initial introduction of roles to model permission checks on Scope. At the very least we need an "admin" role to allow all operations on a scope.

Likely next steps:

• Create in the code an initial set of roles for Scope
• Create a role table to assign Group roles for Scope
• Create a management command to create a Scope, initialize it with an "Admin" group, give it "admin" role on the scope, and assign one or more users to the group

(report time in #395 (closed))