Users can delete Supabase roles, and users without permission can still create roles

# Bug report ## Describe the bug In the database roles page, even though roles described as "Roles managed by Supabase" don't have the delete button available, users can manually add the query param `delete=${roleId}` to the url and the confirmation dialog before role deletion will appear. In the same manner, even though "Add role" button is disabled if the user is not allowed to create roles, he/she can easily bypass that restriction by manually adding `new=true` to the url, and the side panel for role creation will appear. ## To Reproduce Steps to reproduce the behavior, please provide code snippets or a repository: 1. Go to `/dashboard/project/${ref}/database/roles` 2. Add `?delete=${roleId}` to the url. `roleId` is the id of any Supabase role, like `anon` or `authenticated`. 3. The confirmation dialog will appear warning you before deletion (I haven't tested the deletion process).