Reduce signon admin priveleges

https://www.agileplannerapp.com/boards/173808/cards/5255
https://www.agileplannerapp.com/boards/173808/cards/5254

Simplify and restrict what users are able to do on Signon.

 * 'Filter by Role' shows roles that are appropriate for the current user
 * Only be able to administer users lower in the permission hierarchy
 * Restrict the abilities of Admin and Organisation Admin users
 * Can only grant users permissions for apps that the admin user can access
I did try this… `app/views/admin/users/_form_fields.html.erb` continued to show users for all roles so I added the extra code for explicit filtering. I'll give it another go in case I made a mistake last time.