Support download from UI based on user role/group

[kalletlak]

In continuation to #10180, it would be a good feature to enable it on user level instead of instance configuration.

RFC: https://docs.google.com/document/d/19KV2Yplzxl1wnUc5bJDeysGX8vmL24UNi41NlIkX44s/edit

Solution:
This can be achieved similar to how user access is provisioned. Creating a a new role in service provider and assigning role to those users.