from now on, not all unified roles are enabled by default, instead the available roles are hand-picked in the default setup.
For advanced use-cases, the administrator is capable to enable the desired set of available roles.
Picking roles is not easy since the uid is NOT humanly readable, therefore a cli is contained which lists the available, disabled and enabled roles.
The help flag is configured automatically by default already. We don't
need to redo that for every single service.
This also addresses one of the finding of "go race" (#4088)
