* Add `beam-user`, `beam-admin`, and `beam` roles
Migrates the beam roles from the cloud tenant controller, adds descriptions, and
marks `beam` as a "system" role so it does not show in the role selector.
Fixes https://github.com/gravitational/beams/issues/137
* Make `host_cert` permissions more restrictive
* Disable beams roles in OSS
* Extract beams login into a constant
* Fix stray quote
* Further lock down the host cert permissions
* Fix role preset tests
* Using `host_cert.role` in expressions doesn't work