feat: give service account permission to assign initial space members

[dschmidt]

I'm working on a service that requires a space to be available. In order to make the deployment easier I want to create the space on startup.
On startup there is no request context available and hence no user context. I can use the service account to create a space, but I cannot assign a user to it - that's sort of weird. This PR gives the service account the permission to assign users as well.

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.