WL-3192 Remove the realm if it is empty

We are considering a realm to be empty if it has no roles nor members and
before saving we should remove any roles which have no permissions set.
Merge pull request #3 from ox-it/WL-3192

WL-3192 Remove the realm if it is empty
WL-3229 Limit what permissions can be changed.

This defines:
- frozen permissions (can't be changed).
- add only permissions (can only be granted).
Merge pull request #4 from ox-it/WL-3229

WL-3229 Limit what permissions can be changed.
WL-3191 Detect type of ROLES_REF

We are now allowing collections of roles_refs to be defined but we should
still support a String.

Internally these will all be modelled as a Collection now.
WL-3191 Pluralise some of the properties
WL-3191 Just take the first role for wierd check

I'm not sure why this part of the code is executed or what it even does.

Matthew and I agree it shouldn't really be there and will probably result
in buggy behaviour.

The code is probably hit rarely enough that it doesn't matter, so instead
of converting this code to handle the new Collection type, just take the
first element and use that.
WL-3191 Add all the roles uniquely

Now that we are adding roles from multiple realms, let's make sure they
only appear once each.