Role indexing

The purpose of this MR is to help "de-normalize" the indexing of role information for gated discovery. There will be a related MR in ddr-admin to follow. I used the index field name EFFECTIVE_ROLE for consistency with the legacy POLICY_ROLE and RESOURCE_ROLE fields. In all three cases the index values are the agent strings. I.e., EFFECTIVE_ROLE represents "agents having an effective role on the object". In turn "effective role" means any role set in resource scope on the object itself -- OR -- any role set in policy scope on the object's admin policy (i.e., collection).