Add read_vulnerability to member roles and start using it

Add a column called read_vulnerability to the member_roles table and incorporate that logic into permissions checks.

Also update members roles API endpoints to allow creation of member roles with manage_vulnerabilities. There should be validations that ensure this permissions is only being added to member_role records with a base_access_level of Reporter per the discussion above about which roles should be able to have this custom role. After this step is done, it will be possible for a user with the Reporter role + custom role with manage_vulnerabilities: true to view and manage vulnerabilities.