Create a new role that does not allow reading/viewing anything unnecessary for ABAC based key configuration

[dmihalcik-virtru]

The current 'standard' role provides read access to several endpoints that are not necessary for ABAC based key configurations, and provides data within the endpoints that is unused and may contain more information that we do not want to be available to all clients, notably subject mappings.

The suggestion is to create a new role that has:

• access only to necessary endpoints to encrypt and decrypt with ABAC autoconfiguration
• removes or does not include subject mappings or other information beyond what is required for autoconfiguration