Make role names an enum in the DB

Followup to #7477, especially https://github.com/oxidecomputer/omicron/pull/7477#discussion_r1942129596.

Role names are currently represented as free-form strings, but as far as I know the only actual values are admin, collaborator, viewer, or external-authenticator. This was originally expected to be a more flexible system, but we've managed to get a lot out of this basic set of roles. After the cleanup in #7477 made clear we are not using a dynamic list of roles, we have an opportunity to simplify things even further by locking down the set of roles to a Rust enum backed by a Rust enum.

https://github.com/oxidecomputer/omicron/blob/2561a7aac1d763d586b32c33ca8d64080b15c890/schema/crdb/dbinit.sql#L2919-L2922

https://github.com/oxidecomputer/omicron/blob/2561a7aac1d763d586b32c33ca8d64080b15c890/nexus/db-model/src/role_assignment.rs#L56-L65

External API structs

Missing external-authenticator because it is never exposed externally.

https://github.com/oxidecomputer/omicron/blob/2561a7aac1d763d586b32c33ca8d64080b15c890/nexus/types/src/external_api/shared.rs#L104-L110

https://github.com/oxidecomputer/omicron/blob/2561a7aac1d763d586b32c33ca8d64080b15c890/nexus/types/src/external_api/shared.rs#L127-L131

https://github.com/oxidecomputer/omicron/blob/2561a7aac1d763d586b32c33ca8d64080b15c890/nexus/types/src/external_api/shared.rs#L146-L150

Start by reading schema/crdb/dbinit.sql, nexus/db-model/src/role_assignment.rs, and the cited external API structs to trace how role names are represented. Follow existing role references and verify that the database and Rust representations use the four listed values while external API types continue to omit external-authenticator.