Class: CRole  - X-Ref

This class abstracts the concept of a user Role, which is, in effect, an ARO
group in phpGACL speak.  phpGACL has a few constraints, e.g. having only a
single parent group, from which all other groups must be determined.  The
parent for Roles is 'role'.  You can create parent trees, however a role
cannot be its own parent.  For the first pass of this, we limit to a single
depth role structure.

Once a Role is created, users can be assigned to one or more roles, by adding
their user ARO id to the group. All users are given an ARO id which is separate
from their user id, but maps it between the w2P database and the phpGacl database.

Roles, like individual users, can be assigned permissions, and it is expected
that most permissions will be assigned at role level, leaving user level for
just those exceptions warranting it.  Permissions are added as ACLs.

If a role is deleted, then all of the ACLs associated with the role must also
be deleted, and then the user id mappings.  Note that the user ARO is _never_
deleted, unless the user is.