[ee] feat: instance groups instance-level role support

Add ability to assign instance-level roles (superadmin/devops) to
instance groups. Group members automatically receive the role with
proper precedence: manual elevated roles always win, superadmin > devops.

- Migration: add instance_role to instance_group, role_source to password
- Role propagation on all mutation paths (add/remove/update/delete/import)
- SCIM sync integration (companion PR: windmill-ee-private#463)
- Frontend: role toggle in group editor, role column in tables,
  role source indicator in superadmin settings

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: alpetric