beardo

feat: allow account role to be set to none

2

## What was changed If a user was added via SCIM, setting their account role to none is valid. The call will fail if the user is not a SCIM...

## What was changed Adds the metrics read role for service accounts. ## Why? Upcoming role allowed for service accounts.