User management refactors

[begelundmuller]

1. Add a new org-level role External that doesn’t have access to anything by default
2. Grant the External org-level role to current and new project-level members (unless they already have another org-level role)
3. Add an Editor org and project level role that can manage members and create resources, but can’t do things like manage env vars, billing, logos, or override security rules (e.g. mimic another user)
4. Fork the current all-users group into all-users and all-internal-users (which excludes members with role External)
5. Add an org-level setting default_project_role_for_internal_users that specifies the role to grant the all-internal-users group on new projects. It will default to Viewer (current behavior) with support for specifying None.
6. Change the org member listing APIs to include the number of groups and number of projects that each user belongs to (required for the new listing UI).
7. Change the group listing APIs to include the count of members.