WL-3191 Add read access to existing roles

This code was broken during some static NPE analysis or something. It
ignores the case when role is not null. It's quite possible that a role
is already defined on a resource, but doesn't yet grant READ access, e.g.
if it has been set up using the permissions helper.
WL-3191 Only count READ roles

When determining which roles are defined for role-based access, only
consider those that grant READ access.

This exists because it is possible to define a role which doesn't grant
read access but will still consider this as role-based access.

This currently blocks adding role-based access and removing it.
WL-3191 Wrap inconsistent state in runtime exception

When getting a role that doesn't exist it is possible that there will be
a role already defined exception. In this case currently an NPE will be
triggered.

Instead, an `IllegalStateException` which wraps the `RoleAlreadyDefined`
is thrown in this case.
Merge pull request #28 from ox-it/WL-3191

WL-3191 Read permissions are detected correctly.