Handle UserRole changes on upgrades and downgrades

On Downgrade:
- archives all custom `corehq.apps.users.UserRole` (not to be confused with `django_prbac`)
- sets all `WebUsers` `domain_membership.role_id` to the Read Only `role_id` if they were using this custom role
- sets all `CommCareUsers` `domain_membership.role_id` to `None`
- resets all non-custom roles to have the same permissions as when the domain was initialized.

On Upgrade:
- un-archives all custom `UserRole`s on upgrade