This is a key component to configuring a Coder deployment entirely as code, with no clickops, such as manually setting roles or creating the owner user.

As a part of this, we should add a way to start the coder server for the first time without showing the /setup to make a built-in user and instead rely on the identity provider to set a user as an "owner" within Coder.

If something breaks, the create-admin-user command can be used.

Right now we only sync groups on login, would this still be ok?

@coadler is this something we should be doing with SCIM instead of checking claims on an oauth login?

Right now we only sync groups on login, would this still be ok?

This feels fine for the first iteration considering its the same behavior for groups and both are permissions-related.

However, can we also supporting mapping like we do for groups? (e.g. coder-admin role in IDP -> Owner role in Coder)

@bpmct I am only implementing site wide roles right now. We have org roles too, but we probably should not include those for now?