Explicitly set ALL_FACILITIES role for ADMIN users

[emyl3]

Description

As part of decisions made during the Okta migration epic, we want to explicitly add the ALL_FACILITIES role for users with the ADMIN role instead of inferring admin users have all facility access.

Change requested

Ensure all users that are given the ADMIN role are also given the ALL_FACILITIES role.

Additional context

• Currently, the only flow that explicitly grants an admin user the ALL_FACILITIES role is when changing a user's permissions to admin via the support admin "Manage users" tool.

• Ensure other flows also explicitly grant admin users the ALL_FACILITIES:

  • When verifying an org, org admin is created
  • Changing group access in "Manage users" page per organization
  • When adding a new admin user to an org
  • Other flows not listed?

Open questions

• How should we handle existing users with ADMIN roles but do not have the ALL_FACILITIES role?