Add new admin role

[Spablob]

Description

Safe migration scripts plus a script that adds a new admin role to the safe governance that will control the selected selectors. Changes using these selectors will be cancellable by the security council.

[Ramarti]

-[x] Correct multisig addresses
-[x] Correct sc addresses
-[x] All relevant methods
-[x] Granted the roles

[Spablob]

• All relevant methods setTargetRole Missing: -- IPAssetRegistry.upgradeIPAccountImpl
  This already belongs to role id = 1 = UPGRADER_ROLE

• Granted the roles -- Does it make sense to set this to Sec council multisig? Who cancels them?
  the role is granted to the governance multisig and the guardian role to the security council multisig - see here:

  protocol-core-v1/script/foundry/new-admin-role/GrantNewAdminRole.s.sol

  Line 237 in 74a41ce

  _generateAction(

[Spablob]

@Spablob fixed formatting and typo, what I meant is IPAssetRegistry.setTargetRole is missing as target role. You are right about the role assignment, checking that box.

I believe there are only 3 restricted functions in IPAssetRegistry contract - 2 of which belong to the upgrader role - so there is only 1 function for the new role. So it should be ok as-is.

[kingster-will]

One general question: instead of introducing a new admin role scoped to selected selectors, why not make ADMIN_ROLE operations themselves cancellable by the Security Council (via a guardian)?

[Spablob]

One general question: instead of introducing a new admin role scoped to selected selectors, why not make ADMIN_ROLE operations themselves cancellable by the Security Council (via a guardian)?

That was the original idea but the ADMIN_ROLE cannot be cancelled except by itself.