Add a form field to assign roles to users using Shadow

[Aldus83]

At the moment, roles are assigned manually, by altering the JSON of the user node by hand.
We would rather have something visual, like a dedicated Shadow form, to allow administrators creating and assigning roles visually.

This approach should include rules for deciding "which role can assign which role"