*8095* add migration code for roles -> user groups during upgrade