[BE] Do not allow custom role to be created if name is not unique

Multiple custom roles can be created with the same name, but different permissions:

This can be very confusing because the dropdown selector to assign a role to a person/group only shows the name, and it ends up looking like duplicate items when it's actually different roles with the same name:

To avoid this confusion, we should restrict it so that created custom roles must have a unique name across a group for SAAS, and across the entire instance for self-hosted.