Add Viewer role

[knolleary]

Adds a Viewer role to the platform.

They are full members of a team, but with read-only access to everything.

---

Remaining work:

• tests around api access. Not sure how extensive to make it yet as needsPermission does all the heavy lifting
• doc updates
• give user read-only access to the editor

[knolleary]

@hardillb I've marked this ready for review, but it isn't ready to merge yet. There will be some doc updates to follow - but wanted to give you the go ahead to start looking at the code. You'll be glad to hear, despite this requiring changes in the oauth flows, they are actually pretty limited in nature.

There will be a companion PR in the nr-auth repo shortly.

[hardillb]

@knolleary OK, will look after lunch

[hardillb]

@knolleary Are you going to add the tests with the doc? Assuming so, happy to merge this

[knolleary]

Yes - the tests will be more around the invitation workflow that is coming in a later pr