NXCM-5448: resolve role permissions using single read lock, rather than repeatedly taking and dropping lock for the role and each of its sub-roles/privileges