Application roles and groups crd

Based on discussion https://gitlab.cern.ch/webservices/webframeworks-planning/-/issues/233. Some points to clarify:

• Should we add a finalizer and delete the role when the corresponding cr is deleted?
• What should be done with already existing Roles (The error from the API will be"Duplicate Entry") ? Should we discard the new AppRole or delete the one in the API and create the new one?
• Current implementation will expect ApplicationRegistration.Name == ApplicationRole.Name, is this a correct assumption?
• What should be done regarding the Status WaitingForGroupCreation, should we put the CR back to the Reconcile queue? Is there a better approach?