Scheduling of multiple roles

Hi,

Not sure how to summarize this in the title so sorry if it was confusing..
In our on-call, we have multiple roles where one requires a higher level of permissions than the primary. Let's call them primary and secure. All members of the secure role will be part of the primary role as well, but there are a couple of people in the primary role that is not cleared for the secure role.

I would therefor like the scheduler to only schedule an extra for the more secure role when necessary, i.e when someone without the secure role is scheduled for primary.

Example:

Primary:
Mark
John
Fred

Secure:
Mark
John

Weekly schedule:
W1: Mark
W2: John
W3: Fred & Mark
W4: Mark
W5: John
W6: Fred & John

I haven't figured out a way to do this with the current version, so I guess it needs another scheduling algorithm?
It's difficult to explain, so I hope this makes sense.

Start by locating the scheduler implementation and existing tests for multiple roles, then reproduce the Primary and Secure example from the issue. Define the scheduling behavior for overlapping roles and confirm that extra Secure assignments occur only when the Primary assignee lacks Secure membership.