Provide a means to grant users a Full Access Override

[tsmyre]

If I restrict access to all projects on an instance, there’s currently no way for me to grant a site-wide entitlement that would allow a reader/RG the ability to read any or all projects.

In Slack we talked about two approaches to this: building out a global entitlement or creating a new user role.

If we did it through entitlements, we could manage it at the installation level similar to what we do at the project level. This approach would require new views.

Alternatively we could make a new type of user role (e.g., Full Access Reader) and set it in the existing user role field. With this approach we'd need to think through how this would work for granting the same to a reading group.