WL-3190 Content tool respects new kernel inheritance rules

The way the kernel handles inconsistencies caused by inheritence of roles / groups is changing in ox-it/wl-kernel#27.

This pull request is largely divided into two parts:
  1. Update the tool to make sure that it doesn't try to add or remove a role which is inherited.
  2. Currently if a resource inherits a role then this will be displayed instead even if it has group access. This prioritises group access for the access label.
     + I've refactored the code that generates the short access label which is shown in the resources list.