restrict roles visible to javascript to @domain_root_account

fixes CNVS-16196

test plan:
 * add a user to a course in account A, and as an admin in account B
 * view source when visiting account A, and look for current_user_roles
   in the ENV for js.
 * it should include student, but not admin
 * when visiting B, it should include admin, but not student

Change-Id: Ic69da40dcdd3858840a34c260d75b537b4779c07
Reviewed-on: https://gerrit.instructure.com/42542
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>