Convert tabs to spaces; whitespace only change
LimitToRolesForTicket never worked because of non-interpolating single quotes
Handling roles on arbitrary objects in the rights editor

The rights editor now supports editing rights on arbitrary roles on any
object, not just queues and globally.  (It still requires you extend RT's
core roles with your own, of course.)

Adds a new method on RT::Groups, LimitToRolesForObject, which
limits by Domain and Instance appropriately for the object given.  The
new method abstracts away more of the details of roles on objects.
Automatic friendly descriptions for arbitrary role groups

SelfDescription isn't used by core RT, but by providing generic support
in core, extensions which add role groups don't need to override the
method for any non-core code which may use it.
Convenience method to load arbitrary role groups based on an object

Rather than requiring the caller to discern the class of object and call
one of the class specific load methods, just pass in the object itself
and be happy.

RT::Test->add_rights now uses this and as such supports granting rights
to role groups on objects other than queues or the global system.
CreateRoleGroup can take an Object in place of Domain and Instance

Paves the way for easier creation of role groups on arbitrary objects.

Flesh out the documentation for CreateRoleGroup while I'm at it.
Don't assume new role groups are for tickets/queues

CreateRoleGroup no longer assumes the role is one RT::Queue will know
about when validating.  Instead, RT::Group maintains a map of role names
to valid classes.  The core roles are hardcoded, but extensions are free
to push into the %ROLES package variable and start using CreateRoleGroup
for roles on other object types.
Implement RT::Queue's methods about roles using the new methods of RT::Group

Now extensions can add new roles to queues/tickets as well, at least at
the API level.
Refactor role registration metadata into RT::Record

The RegisterRole method replaces pushing into %RT::Group::ROLES and
knows how to handle equivalent classes and RT::System.  This allows
greater flexibility to add metadata in the future (such as manageable
vs. unmanageable role types).

RT::Record->Roles replaces RT::Group->RolesOf(RT::Record).
HasRole method to check role existence on a class
Bail out of LoadRoleGroup if the object passed is unloaded

Avoids loading up a random role instance.
Require Instance (even if it's 0) when creating a new role group
Block duplicate role group creation
Set system role groups' Instance to RT->System->id

These role groups are now consistent with other role groups instead of
using the legacy Instance value of 0 (which doesn't match
RT->System->id).
Group.Instance is numeric, drop quoting and incorrect comment

This comment used to be true but became false many moons ago.
Document transaction requirement of CreateRoleGroup and follow our own advice

System role groups weren't created inside a transaction despite role
group creation expecting to be able to Rollback.  Document how to toggle
the expected transaction state and then use it in
RT::Handle->InsertInitialData.
Refactor role group check on Principal into a public method

Greater abstraction of the /-Role$/ check means easier changes down the
road as necessary.
Sort object types for stability when combining ACE hashes

Some rights are announced by multiple classes but currently have
different descriptions.  Sorting at least makes the descriptions stable
in the global rights list.
Restrict rights granted to system role groups

All roles include a system-level group which is used for global role
rights.  System level rights are a combination of global-only rights
(those announced in RT::System itself) and rights announced by other
ACL-able classes (%RT::ACE::OBJECT_TYPES).  System role groups, however,
are only registered to certain classes, and displaying or allowing
granting of rights announced by classes other than those to which the
role is registered makes no sense as those rights will never be checked.

This only matters for system role groups because AvailableRights in
other classes is restricted to the correct class by virtue of being in
the correct class itself.
Basic tests for variable AvailableRights

Adds a new dep for testing, Set::Tiny, which is currently used for a
single test.  The expectation is it will be used more in the future,
hence the inclusion as a dep.