Read-only role for organization settings (IdP group mappings, etc.)

Add a built-in or custom-role action that lets a user or API key read organization settings, including IdP group mappings, without being able to change them. Today viewing IdP mappings requires Space Admin. With Space Reader on root, stacks are visible but the IdP mappings API returns unauthorized. Spacelift support confirmed this is intended and that no read-only admin or auditor role exists.

We want an AI agent connected through the Spacelift MCP server to inspect our RBAC setup (which IdP groups map to which roles) and report on it. Granting Space Admin to do that is far too much access for a read-only task.

Something like "Organization settings reader" or a read-only auditor role would cover it.