Allow 'role update' migration to specify only new/updated policies

[gggeek]

Currently role update migrations need the developer to specify all policies for a role.

It would be nice if it was somehow possible to only specify the new/updated/removed policies, and leave the other existing policies unmodified.

This is a bit hard given the eZP api for dealing with policies...