WL-3191 Also include roles for content

When using the permissions helper from the content tool, the roles are
obtained from owning site. This is good because you want to be able to
define permissions for the various site-wide roles you have enabled but
it does not let you assign permissions to the role that you have defined
to an individual resource.

This makes the permissions helper accept a list of `ROLE_REF` realms
so that we can specify multiple sources for role information.

This should degrade nicely to the original interface of just a String object.