Expose the ability to grant rights to roles on custom fields

Roles for the CF's LookupType — specifically the record class that CFs
are added to — are shown.  This means the roles listed will vary
depending on the type of CF.  The utility of this is that you can grant
Requestors rights on per-CF basis instead of granting them same rights
on all CFs on a per-queue basis.  Previously the only option for the
former was to use user-defined groups and grant permissions a bit to
broadly, which was only acceptable because you could then limit who
could get to the CFs in the web UI by rights like ShowTicket.  This
workaround was a bit of a drag, though.

Since there is no context object — and splitting out the same set of
roles for each record the CF is added to leads to a horrible UI — only
support granting rights to the global role groups.

There is certainly utility in being able to grant a right to a role
group on a specific CF application (i.e. a specific queue), and the ACL
system supports it.  However, the UI would be burdensome without a lot
of work, and it adds complexity to an already complex rights interface.
Merge branch '4.2/grant-rights-to-roles-on-cfs'