CORE-884 add read:UserRole permission to AuditProgramReader

Because some program roles are being examined in if_can_create_request/if_can_reassign_request/if_can_create_response helpers, no-access Auditors were having issues due to not being able to read UserRole objects for the Programs they were auditing.  This has been added to the RBAC to address the problem.