Safer, predictable handling of SSO roles

Two changes make SSO role assignment predictable. Restricting sign-in to certain directory groups no longer resets roles: it previously reset every SSO user to the default role at each sign-in, silently undoing an administrator role granted by hand. Now only a provider whose roles are managed by the identity provider changes roles.

Administrator is also no longer available as a default role. A provider configured to default new accounts to administrator now creates them with the user role instead; grant administrator through a rule under SSO roles. Existing accounts keep their current role.

Self-hosted operators should review their single sign-on configuration for a default administrator role before upgrading.