Roles: Support multiple roles per user

[HeyJoel]

We've had a request on gitter to support multiple roles per user and therefore aggregated permissions:

I think its a fairly common use case to able to assign multiple roles to a user as soon as you start to build something even slightly more complex than a very basic website. I will try to give an example: If I have the roles 'Content Creator', 'Content Reviewer', 'E-Commerce Admin'. Each of these perform different functions and have access to different screens or capabilities. Without assigning multiple roles, I won't be able to make a user 'Content Reviewer' and 'E-commerce Admin' while keeping another user as just 'Content Reviewer'.

This makes the role system a little more complicated but it would be a good feature to have. Some role systems that aggregate permissions also allow the ability to deny permissions which further complicates the system, but I think this is something we can do without; multiple roles should only combine granted permissions.