Allow creation of group-level custom-roles on self-managed instances

- Introduce beta feature-flag, restrict_member_roles,
which is disabled by default.
- When it's off, admins can create group-level and instance-level
custom roles when on a self-managed instance.
- When it's on, admins can only create instance-level custom
roles on a self-managed instance.
- When on SaaS mode, only group-level roles can be created.

Changelog: added
EE: true