updates to org & loc

Rather than being exposed at the per permission level, the org & loc are moved to the roles level to allow a better flow and management of them. The underlying data structure remains unchanged.

This p-r includes @ehelms work related to the bastion plugin. With it, the roles-plugin may be used with foreman standalone. Some functionality is broken (eg. this plugins api routes are missing).