enhancement: do not enable all roles by default.

from now on, not all unified roles are enabled by default, instead the available roles are hand-picked in the default setup.

For advanced use-cases, the administrator is capable to enable the desired set of available roles.

Picking roles is not easy since the uid is NOT humanly readable, therefore a cli is contained which lists the available, disabled and enabled roles.

services/graph/pkg/validate/libregraph.go

@@ -84,6 +84,8 @@ func rolesAndActions(sl validator.StructLevel, roles, actions []string, allowEmp
 	var availableRoles []string
 	var availableActions []string
 	for _, definition := range append(
+		// fixMe: why twice!?
+		// fixMe: should we consider all roles or only the ones that are enabled?
 		unifiedrole.GetBuiltinRoleDefinitionList(),
 		unifiedrole.GetBuiltinRoleDefinitionList()...,
 	) {