Allow Authenticates plugins to set roles/groups

Makes a change to talons.auth.interfaces.Authenticates that
allows a plugin to modify the supplied talons.auth.interfaces.Identity
object and set roles and groups attributes. Two discovery methods are
added to the Authenticates plug for "downstream" callers to use
in determining if a plugin is able to set either roles or groups
on an identity.

Documentation for an external authenticator that sets the roles
attribute is also included.

Addresses Issue #10