[Do Not Merge] Reduce Signon Administrator privileges

Initial attempt (test fixes still to come) to simplify and restrict what user's are able to do on Signon.

 * 'Filter by Role' shows roles that are appropriate for the current user
 * Only be able to administer users lower in the permission hierarchy
 * Restrict the abilities of Admin and Organisation Admin users
 * Can only grant users permissions for apps that the admin user can access.