ENG-6817: Enable CREATE ROLE via live DDL.  Add some basic testing.

-- Make an unclear error message a little less useless, see ENG-7185.