Add activity/event tracking around user role changes

[acoffman]

User role changes are currently just database updates in the admin backend. Cara asked if it was something that could be queried and it feels like it should be. Do we want to make this a full blown "activity" or an event or some separate audit trail? Regardless, we should track it more formally.