feat: instance groups instance-level role support (#8404)

* [ee] feat: instance groups instance-level role support

Add ability to assign instance-level roles (superadmin/devops) to
instance groups. Group members automatically receive the role with
proper precedence: manual elevated roles always win, superadmin > devops.

- Migration: add instance_role to instance_group, role_source to password
- Role propagation on all mutation paths (add/remove/update/delete/import)
- SCIM sync integration (companion PR: windmill-ee-private#463)
- Frontend: role toggle in group editor, role column in tables,
  role source indicator in superadmin settings

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: update ee-repo-ref to 278a3887f759f9d1146554baa0765518d5bc70f2

This commit updates the EE repository reference after PR #463 was merged in windmill-ee-private.

Previous ee-repo-ref: b407fe4604153d09ff223e11d43c2df83a1de5d0

New ee-repo-ref: 278a3887f759f9d1146554baa0765518d5bc70f2

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>

Author: 4 people