Don't expose "old" roles in the new role assignment UI

With the introduction of grants, we aim towards making some of the existing roles obsolete.
This is mostly true for roles that allow `RUD` actions on entities (or all entities)
Examples being the `Alerts Manager` and the `Reports Manager` role.

With the grants system we only want users to be using "new" roles which cover a different
permissions aspect of the product. These roles will cover things like the creation of entities and
the permission to execute searches.

That's why we should add something like a `new` flag to the roles collection,
and only allow these roles to be assigned to users in the UI