When assigning a V1 role to a group, place the role binding(s) in the correct scope based on the role being assigned.

This will affect at least the following places:

• Normal assignment through V1 APIs.
• Assigning platform default roles to a custom default access group when it is created.