Enable cluster-spec to add roles to its groups

The :roles passed to the cluster-spec are inserted into its groups' roles.