WL-3191 Read permissions are detected correctly

When using role-based access we are really talking about defining roles which have the `AUTH_RESOURCE_READ` permission. This is often taken for granted because when a role is created it will automatically have this permission enabled.

However it is possible to define a role which doesn't not have this permission enabled but this will still be detected in some parts of the UI as having role-based access enabled. This can be done trivially using the permissions helper (it is possible to define a role with no permissions but that's another matter).

WL-3191 addresses the fact that roles defined against resources are not appearing in the permissions helper. Currently they need to be defined against the site to appear. Since WL-3191's fix makes it easier for the user to produce dangerously configured roles, let's tighten up some of the underlying logic first.