Add "user roles" endpoint to the API

Much of this code was moved from the management app
Hide email addresses if requested by the user

If the `allow_email_contact` flag is false user exports will return not
return the email address.

However, many external clients would like to sync data between OTM and,
say, salesforce. We provide the `email_hash` field which is a sha256
hashed version of the email. This can be used to match up emails to
existing databases without exposing the user to undue privacy issues.
Merge pull request #1155 from OpenTreeMap/topic/user-roles-endpoint

Topic/user roles endpoint