All changes required to enable assigning users a role in a private program.

Also, minor improvements to the ggrc.migrate wrapper for alembic.