This commit introduces the system reader role to the group API, making
it easier for administrators to delegate subsets of responsibilities
to the API by default. This commit also maintains the ability for
any user to be able to fetch their own group memberships, which
encapsulates a bunch of tests for what regular project users can do
with groups.
Subsequent patches will incorporate:
- system member test coverage
- system admin functionality
- domain reader functionality
- domain member test coverage
- domain admin functionality
Change-Id: I24ff27da79bb01322e05c6d8cd37f02693fd5b9f
Related-Bug: 1805369
Related-Bug: 1808859
Related-Bug: 968696