Auto-create access and admin organizational roles in root workspace

[kylape]

Is your feature request related to a problem? Please describe.
We're trying to land on a reasonable set of bootstrap RBAC policies that get added along with organizational workspaces.

Describe the solution you'd like
Having two roles applied to the root workspace:

• <org-name>-access: Grants access verb to org workspace
• <org-name>-admin: Grants edit verb to org workspace (should translate to cluster-admin)

This should likely be implemented in the organizational workspace controller.

[sttts]

For non-org workspaces we grant access/view/edit/admin verbs to clusterworkspaces/content. To align, we have to do the same here, i.e.

• <org-name>-access: Grants access verb to the org clusterworkspace/content
• <org-name>-admin: Grants edit verb to the org clusterworkspace/content (should translate short-term to cluster-admin, but medium term to org-admin).

What an org-admin can do, we will eventually specify in a policy that applies to only org workspaces (via ClusterWorkspaceType.spec.policies, compare https://docs.google.com/document/d/1SD2gVJk0FNPV9bsJucTwo9F1esNPa89_rmn5Roq7Ca4/edit#heading=h.d5ctd5ff38z9).

Today the upper verbs are mapped according to

verbToGroupMembership := map[string]string{
		"admin":  "system:kcp:clusterworkspace:admin",
		"edit":   "system:kcp:clusterworkspace:edit",
		"view":   "system:kcp:clusterworkspace:view",
		"access": "system:kcp:authenticated",
}

(source https://github.com/kcp-dev/kcp/blob/main/pkg/authorization/workspace_content_authorizer.go#L126). The meaning of the group memberships is defined through the bootstrap policy, which we extend via https://github.com/kcp-dev/kcp/blob/main/pkg/authorization/bootstrap/policy.go#L27. With the upper gdoc we will be able to have different policies depending on the workspace type (here "Organization").