Add "tenant selection" to user roles

[kbilev]

Is your feature request related to a problem? Please describe.
A tenant may have different kind of users (Administrators, standard users, management)
An Administrator cannot change the user role of his users as he is not allowed to change users in his tenant.
If he would have user edit rights, he could change for example his user role to "Administrator"
This role or others should not be available for a tenant

Describe the solution you'd like
A user role could have an "allowed tenants" field where the global admin can define which tenant should have access to an user role