roles: add service-level Workspaces service admin role

[bobheadxi]

Part of https://linear.app/sourcegraph/issue/CORE-363/workspaces-internal-trigger-to-suspendun-suspend-a-workspace - this will be used to gate access to the upcoming AdminstrationService for administering workspaces.

Test plan

CI

[eseliger]

I think I find it slightly odd that you have to add a role that only exists in the service here, but just a random thought

[bobheadxi]

I think I find it slightly odd that you have to add a role that only exists in the service here, but just a random thought

This is partly to make sure integrators hold it right, and to give us a central index of the available roles, similar to scopes

[unknwon]

Source code as a registry 😎