rest: move groups in sso under the school objects
rest: clean up DNs/ids
rest: Add roles to SSO

The classic Roles in puavo-web are now deprecated.
puavoEduPersonAffiliation will used as the roles from now on