Add describe() method to RevokeAllRolesCommand to detail in the actionlogrecord all the roles that are being revoked for the roleAssignee

Related to issue #2912 - an enhancement rather than a bug or feature request

Add functionality to the RevokeAllRolesCommand to record in the actionlogrecord table all the roles that are being revoked for the roleAssignee and all the Groups they are being removed from.

For auditing and tracking purposes, this logging in the actionlogrecord is important for ADA.

Not sure what a logical and efficient solution is as looping through a possibly large number of roles (ex. filedownloader role could be hundreds) to get the info for the actionlogrecord and then looping through again to do the actual revoke is not efficient. If it were a double looping solution, would there be one actionlogrecord for each role revoked or would there be one actionlogrecord entry with a potentially very long actionsubtype string detailing all the roles revoked? Alternatively, a string could be built up in the revokeAll() method but it could be very long and it would have to be the return value of the revokeAll() method, changing the class interface, or requiring a new method that does the same thing but returns the built-up string to log.

Ideally the revokeRoleCommand() could be reused for each role in the RevokeAllRolesCommand - resulting in one actionlogrecord entry for each role revoked - but I'm not sure if that's technically possible (can you call a Command from within another Command?) or if there is some underlying reason for not doing that originally. That solution also wouldn't manage recording in actionlogrecord the groups the roleAssignee is removed from in the RevokeAllRolesCommand.

I notice there is a RemoveRoleAssigneesFromExplicitGroupCommand that also doesn't have a describe() method. If it did, that could potentially be called repeatedly to remove the user from each explicit group and to have that logged in actionlogrecord. Again, I'm not sure if that's possible or acceptable or efficient.

Open for discussion on how to approach this.

Start with RevokeAllRolesCommand, its revokeAll() method, and the related revokeRoleCommand() and RemoveRoleAssigneesFromExplicitGroupCommand entry points. Determine how role and group removals are represented in actionlogrecord, then agree on whether logging should produce one record per removal or an aggregate record. Done means all revoked roles and removed groups are auditable without an inefficient or incompatible command interface.