Reduce signon admin priveleges

https://www.agileplannerapp.com/boards/173808/cards/5255
https://www.agileplannerapp.com/boards/173808/cards/5254

Simplify and restrict what users are able to do on Signon.

 * 'Filter by Role' shows roles that are appropriate for the current user
 * Only be able to administer users lower in the permission hierarchy
 * Restrict the abilities of Admin and Organisation Admin users
 * Can only grant users permissions for apps that the admin user can access
you could model this information as `Roles::Admin.manageable_roles` in `lib/roles/admin.rb`. that will allow you to change the ability to look like:
```ruby
       :perform_admin_tasks, :resend_email_change, :cancel_email_change, :assign_role],
          User,
          { api_user: false,
            role: Roles::Admin.manageable_roles }
```
... and not repeat yourself.