RequiresAnyRoleAttribute.HasAnyRoles made virtual

The motivation behind this is to allow for overriding just HasAnyRoles to alter the list of target roles at runtime.

A few examples:
1. Adding super-priviledged role that are able to access anything.
2. Allowing for hierarchical nested roles (e.g. "Manager" role should have all the access that "Operator" have)