WL-3191 Also include roles for content

When using the permissions helper from the content tool, the roles are
obtained from owning site. This is good because you want to be able to
define permissions for the various site-wide roles you have enabled but
it does not let you assign permissions to the role that you have defined
to an individual resource.

This makes the permissions helper also load the roles that are defined on
the realm for that particular bit of content.

This is a bit of a half-solution because you would probably also want to
be able to define special permissions for roles that are inherited from
intermediate resources, but that would require lots of work in the kernel.

Depends on ox-it/wl-kernel/pull/28 to behave nicely.