Fix $user->roles($purpose)

[distantnative]

Description

Summary of changes

• User::roles() has a new optional $purpose parameter to pass a user action (create or change). If one is passed, the roles collection is filtered via $roles->canBeChanged()/$roles->canBeCreated() which checks if the current user has the permissions to apply the action to each role.
• ::roles() doesn't return only the current role for non-admin users but all available roles

Reasoning

Available roles depend on the context as they depend on whether the current user has permissions to e.g. create a user with a certain role or change the role to a certain role.

Additional context

We need to pass the $purpose parameters, e.g. in user dialogs, in a subsequent PR.

Ready?

• In-code documentation (wherever needed)
• Unit tests for fixed bug/feature
• Tests and CI checks all pass

[bastianallgeier]

I've come to the point where I really see the argument as a valid solution and would not overthink this anymore tbh.