feat(workspaces): add workspaceRole to LimitedUser type

[cdriesler]

Description & motivation

• The invite flow needs to check if a given LimitedUser from a user search is already a member of a known workspace

Changes:

• Adds workspaceRole to LimitedUser type, modeled after workspaceDomainPolicyCompliant

[iainsproat]

On the philosophy that there are no stupid questions, I'll ask some 😉 :

Are there restrictions on who can query for LimitedUser?

Does the user running the query need to be a member of the workspace in order to see whether the returned LimitedUser is a member of the workspace? i.e. what's stopping a leak of all the workspace membership of users? (which is commercially sensitive info)

[iainsproat]

Would like a clearer description in the PR of the security/confidentiality implications before we merge.

[cdriesler]

Ready for re-review. We now assert that users who query LimitedUser.workspaceRole(workspaceId) are at least members of the given workspace.

With this change, there shouldn't be any security implications. This is parity with current data access, just visible another way. (Workspace members can see peoples' roles)