Update OTM1 migration logic to use InstanceUser

* Create an InstanceUser for each User, with the instance's default_role
* more_permissions() applies role to InstanceUser, not User