Implement the CONTRIBUTOR role for users who can start workflows in a workspace

See #553 (comment 555904)

We need a new workspace role that grants the members of a group the ability to start Workflows in that workspace.

The Debian group (#553 (closed)) is a good candidate for a group that could have that role.

Things to be done:

• #623 (closed) (to help Helmut in orchestrating server setup around this)
• Add a CONTRIBUTOR role on Workspace (!1459 (merged))
• Make sure the Debian group has the contributor role (pending debusine.debian.net ansible setup)
• Disallow starting workflows by default (!1747 (merged))

Allow Workspace contributors to:

• Display the workspace (!1459 (merged))
• Create artifacts (!1459 (merged))
• Start workflows (!1747 (merged))