Add migration to fix system roles

* `ObjectEditor` and `Reader` were missing `ProgramDirective`,
  `ProgramControl`, and `Person` permissions (CRUD, except `Person`,
  which is CRU.
* `ObjectControl` and `ObjectDocument` were combined due to a missing
  comma in a previous migration.