Role graph cleanup

* Create and extra attribute for RoleRequire that allows it to track the
  id of the Role it points to as a parent instead of always using the
  role name.
* Arrange for Role and RoleRequire objects to resolve their parent roles
  whenever a new Role or RoleRequire object is created.
* Instead of having jig client roles be outside the RoleRequire
  machinery, arrange for Jigs to create any needed RoleRequire objects
  when they are initialized.
* Arrange for role cohorts for a role and its children to be
  recalculated and saved whenever a one of its RoleRequire objects gets
  resolved.
* Have RoleRequire ensure that the overall Role graph stays acyclic.
  Attepmting to create a RoleRequire that would cause the Role graph to
  have a cycle will throw an exception.
* Make Role.add_to_node_in_snapshot properly fail when you try to bind a
  Role that has an unresolved parent.