Creating a ClusterRole for mesh-user as part of the bootstrapping operation will provide a better experience for the user.

Differences in how a user can be added:

Current:
$ oc policy add-role-to-user mesh-user some_user -n istio-system --role-namespace istio-system

Proposed:
$oc policy add-role-to-user mesh-user some_user

It is also not necessary to include the mesh-users RoleBinding in the project, as one will be created through the policy command.