Prepare models to handle instance-wide custom permissions

We want to introduce admin-related custom permissions. For this we need to add a new model that will hold the relationship between a custom role and a user. The permissions are not related to any group or project.

Suggestion:

• create a new model, clusterwide
• change the MemberRole model so that base_access_level can be nil if admin-related permissions are defined
• generate first custom permission for admin: read_admin_dashboard