Clarify how the built-in CCM roles are additive

[pauby]

What New Or Updated Would You Like To See?

It's unclear how the built-in CCM roles work by building on top of each other. For example, the 'CCM User' role is required if you want a user to login. If you uncheck that, the user will not be able to login, despite other roles that they may have.

This is desirable as you may have an API user that you don't want to be able to log in, but needs access to Deployment (for example).

If the Admin wants to create their own roles with specific permissions, they can do that. They can also see what permissions any role has.

Why Is It Needed?

There is a little confusion on how the roles built upon one another (they are additive).

Additional Context?

• GitLab issue.