keycloak: Add swh.ambassador realm role

This declares a global swh.ambassador role at realm level as it is not attached to a particular client.

15:28 $ bin/octocatalog-diff --octocatalog-diff-args --no-truncate-details -t staging kelvingrove.internal.softwareheritage.org
Found host kelvingrove.internal.softwareheritage.org
Cloning into '/tmp/swh-ocd.H7JNqMuF/environments/production/data/private'...
done.
Cloning into '/tmp/swh-ocd.H7JNqMuF/environments/staging/data/private'...
done.
*** Running octocatalog-diff on host kelvingrove.internal.softwareheritage.org
I, [2021-04-27T15:28:27.188348 #375689]  INFO -- : Catalogs compiled for kelvingrove.internal.softwareheritage.org
I, [2021-04-27T15:28:27.432175 #375689]  INFO -- : Diffs computed for kelvingrove.internal.softwareheritage.org
diff origin/production/kelvingrove.internal.softwareheritage.org current/kelvingrove.internal.softwareheritage.org
*******************************************
  Keycloak_realm[SoftwareHeritageStaging] =>
   parameters =>
     roles =>
      + ["swh.ambassador"]
*******************************************
  Keycloak_realm[SoftwareHeritage] =>
   parameters =>
     roles =>
      + ["swh.ambassador"]
*******************************************
*** End octocatalog-diff on kelvingrove.internal.softwareheritage.org

Related to T3213

---

Migrated from D5622 (view on Phabricator)