Don't return formview assignments from API

When a form is published, a `singleUse` actor is created and assigned the `formview` role. The actor is for internal use. It is needed for Enketo to access the form (or so it seems: getodk/central#1260).

Right now, assignment endpoints return `formview` assignments. These show information about the `singleUse` actor, especially if extended metadata is requested. The endpoints also allow `formview` assignments to be deleted.

- /v1/projects/:id/assignments/forms
- /v1/projects/:id/forms/:xmlFormId/assignments

I don't think it's helpful to return these actors over the API. They may be confusing to users. We also don't want users deleting these assignments. There are two changes I think we could make:

1. Don't return `formview` assignments from the API. Either we filter out the `formview` role, or we filter out `singleUse` actors entirely.
- I don't think this issue comes up for another kind of `singleUse` actors, namely those used for password resets (who are assigned the `pwreset` role). That's because /v1/assignments seems to return only sitewide assignments (assignments to `*`). So as far as I know, there's no endpoint that returns `pwreset` assignments.
2. This is probably less important, but we could exclude the `formview` and `pwreset` roles from /v1/roles. Those are internal roles, and we don't intend for users to use them to create or delete assignments.