The system grant policies were not taking the default roles work we
did last release into account. This commit changes the default
policies to rely on the ``reader`` role for getting and listing system
assignments. Subsequent patches will incorporate:
- system member test coverage
- system admin functionality
- domain user test coverage
- project user test coverage
Change-Id: I838c85f315864d2f0baf747d6bcc546724e4673a
Related-Bug: 1805368
Related-Bug: 1750669
Related-Bug: 1806762