Only allow strings in user doc "roles" array

We validate that _security documents only contain strings but we have
not done the same for the roles field in user docs. This is a breaking
change as users may have been inserting other things (notably,
objects) in this field.

COUCHDB-1675
Merge branch '1675-fix-roles-validation'