Limit System Overview

I feel that more thought should be consider on what information is showed to the average Reader role (default role). I would like to work the Graylog team to better determine what permissions should be provided to the default reader role.

## Expected Behavior
Users with the Reader role would not be able to see the System tab/dropdown in navigation. They can also could not navigate directly to the pages Overview, Configuration, Nodes, and Enterprise.

## Current Behavior
Users with the Reader role can see the System tab/dropdown in navigation. They could also directly navigate to the pages Overview, Configuration, Nodes, and Enterprise.

## Possible Solutions
Add permission checks on the API and frontend components for all System tab and the Overview, Configuration, Nodes, and Enterprise page information. Reader role would still have access to Streams, Alerts, and Dashboards navigation tabs.

Current Reader role permissions:
https://github.com/Graylog2/graylog2-server/blob/bcf53ec214ea302f8ec3ea0815a0a3c979bbaf13/graylog2-server/src/main/java/org/graylog2/shared/security/RestPermissions.java#L244-L262

Proposed permissions for Reader role would be:
```
DECORATORS_READ,
FIELDNAMES_READ,
MESSAGECOUNT_READ,
MESSAGES_ANALYZE,
MESSAGES_READ
```
* Saved Search permissions could be given as well. But right now saved searches can be accessed by any user. So I can save a search with specific information in it and another user could see it. So this needs to be either removed from default Reader or refactored.

Overall the roles create/edit code should be refactored allowing the choice of permissions from the backend. That way a end user (admin) can create any roles they would like. Not just inherit the default Reader role. Think of a Analyst and DevOps role. The DevOps role would want access to inputs, nodes, configuration for the system. But a Analyst wouldn't need that as they are just searching logs.

## Context
Graylog is often used as a aggregate logging platform that contains multiple sources of logs (often multiple companies information). It is important for users with the Reader role to only be able to access logs, dashboards, alerts, etc. that they have access to. Right now users with the default Reader role can see system wide stats/metrics (including Graylog version and JVM info) and inputs (often containing info about the source). These are all leaking information that I believe a average Reader user should not see nor should see. As they are most likely just using Graylog to browse alerts/logs/dashboards.

From a security standpoint show the average user all inputs, metrics on nodes, and system information (Graylog version and JVM config) gives a compromised user account alot of ground to attack not only the Graylog environment, but also potential Graylog log sources.

## Your Environment
N/A