How to implement security?

all Project Leader could change and create tasks on all projects

No, Project leader can then change and create activities on projects they are affected to with a Project Leader profile.

When you create the role "Project Leader" and "Supervisor", what is the role with more priviledge?

These profiles are completely different.
Suppervisor sees all projects without have to be affected to them, but cannot change items of the projects.
Project Leader has more restricted view (only projects he is affected to) but can change almost everything on his projects.