Allow limiting of available roles for SSO domains on a given team.

### Description

A customer (https://app-eu1.hubspot.com/contacts/26586079/record/0-1/973751) uses teams on FF Cloud to provision dashboards to their customers. They want to use SSO for their customers, with managed group membership enabled - so that the customer can easily add additional employees to the team via their Entra config, but they don't want those customers to be able to access any roles other than dashboard as the NR flows include their intellectual property.

The existing group management allows for management of any role in the team. The request here is to be able to limit which roles can be managed by a given SSO configuration.

I explained that as far as I am aware this is a fringe scenario but that I would raise an issue so we are aware of the request.

### Which customers would this be available to

Enterprise Tier Only (EE)

### Have you provided an initial effort estimate for this issue?

I can not provide an initial effort estimate