Test auth with roles for all auth strategies, not just BasicAuth

Since we run the same tests for all strategies, the configuration should be the
same.
Adapt test auth classes and write tests to demonstrate bug with changing config

The bug in question is that when both `allowed_roles` (can be empty list) and
`allowed_read_roles` or `allowed_item_roles` are specified, the `allowed_roles`
list in the app's config will grow over time, expanding with the items in
`allowed_read_roles` or `allowed_write_roles` at every request that considers
the roles.

This is also true for:

 - ALLOWED_ROLES (changes if ALLOWED_READ_ROLES or ALLOWED_WRITE_ROLES are
   specified)
 - allowed_item_roles (changes if allowed_item_read_roles or
   allowed_item_write_roles are specified)

In order to demonstrate this, the test auth classes `ValidBasicAuth` are changed
so that their `check_auth` method returns `True` if 'admin' is at least one of
the items in the given `allowed_roles`. Previously, they would only accept if
'admin' was the only element of the list.

In addition, three tests are added, specifically testing that the allowed roles
in the app's config do not change between requests.
Fix with expanding roles lists if read/write roles counterpart is specified

Previously, the `allowed_roles`, `allowed_item_roles` and config `ALLOWED_ROLES`
were fetched as a reference and expanded with items from their read/write
sub-specifications, that is:

 - `allowed_read_roles` and `allowed_write_roles` for `allowed_roles`
 - `allowed_item_read_roles` and `allowed_item_write_roles` for
   `allowed_item_roles`
 - `ALLOWED_READ_ROLES` and `ALLOWED_WRITE_ROLES` for `ALLOWED_ROLES`

This becomes a problem for two reasons:

 - **SECURITY:** the list will potentially expand with unintended roles.
   Read-only roles will be copied over to 'allowed roles', allowing access also
   for writing in the next request.
 - **MEMORY:** the list grows without bounds, forever using more and more
   memory.

The problem could be solved in config by specifying roles in tuples, which are
immutable, instead of lists, which can expand. However, this could be confusing
and is not documented. This commit solves the issue in code, by copying the
lists with `list(list_to_be_copied)` instead of using the reference directly.
Fixing sins for flake8
Add Mikael Berg to AUTHORS
Changelog update for #527
Merge branch 'immutauth' into develop