Add upgrade step to clean up orphaned cohort role definitions.

Prior to c933eacd they weren't removed automatically when a role was deleted.