Remove namespace validation for member role

What does this MR do and why?

It removes validation related to the namespace presence.

When we introduced custom roles we wanted them to be associated with group (namespace). But we decided that for self-managed, they should be defined for the whole instance. Those defined for instance do not need (and should not have) group assigned.

This MR also introduces group-only custom roles as SaaS feature.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #429276 (closed)