fixes #5540 - also clone builtin roles during migration
fixes #5489 - don't generate empty search () filters on permissions migration
fixes #3892 - process REMOTE_USER_GROUP_N and REMOTE_USER_GROUP_#, add user to groups based on external user groups.