Expand `pdc-admin` privileges to organization, client management

[bickelj]

Presently, members of pdc-admin can update users and groups in the PDC realm admin interface. Anything more than that, such as adding organizations or clients, needs to be done via the Keycloak realm admin interface. This issue is resolved when members of the pdc-admin group can onboard new organizations, clients, and users without going into the Keycloak realm admin interface.

This is also important given that we are theming the PDC realm interfaces in Keycloak but not the Keycloak realm interface.

See #32 and PhilanthropyDataCommons/service#1903

[bickelj]

In order for the Keycloak theme in the PDC realm admin area to be visible, admins need to go into that realm to onboard organizations (rather than the Keycloak realm admin area). So I think this is a small lift and pretty important.

[bickelj]

Bummer. It is straightforward to grant access to view and edit clients, not so much organizations. We'd probably need to grant full realm admin, which feels like overkill at the moment.

[bickelj]

I suppose there is a question of whether to formally document multiple levels of administrator within the PDC realm. Implicitly there already are multiple levels of access: those who can sudo on the Keycloak boxen, those who are Keycloak admins in the Keycloak realm, those who are Keycloak admins in the PDC realm, and those who are pdc-admin in the PDC realm. My hope is the pdc-admin role can be a safer subset of the "Keycloak admins in the PDC realm" rather than full realm admin.