Create groups rather than adding project members directly to rolebinding

[larsks]

Our current account management api adds project members directly to the edit rolebinding for a project:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: edit
  namespace: test-project-12345678
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: example

If a project wants to add additional RBAC for their project (see e.g. nerc-project/operations#128) this is problematic, because it means they will need to manually maintain a second list of project members. Whenever someone new joins the project, the custom RBAC will need updating to apply to the new members.

We can avoid this problem by creating a group (<project>-members), and referencing that group name in the edit rolebinding. Custom rolebindings can reference this group, which would allow them to apply automatically to new members.