Allow a role to only manage a specific subset of Spaces

[timroes]

A user requested to be able to have a role that doesn't allow managing all spaces but only a subset of spaces. They would like to be able to limit management rights (and I assume something similar for read permissions) by a specific space prefix (though I assume there might be other alternatives). That way they can allow, e.g. team leads to only allow managing their teams spaces and not all spaces of other teams, without requiring one central space admin that manages spaces for all the teams.

[elasticmachine]

Pinging @elastic/kibana-security

[legrego]

This was opened first, but I'm going to close this as a duplicate of #51759