Support "roles" claim when it contains a string (for AD FS)

AFAICT this code requires the access token to always contain an array of roles:
```
claimRolesRaw, ok := claims[ra.rolesClaim].([]interface{})
if !ok {
logger.Error().Str("rolesClaim", ra.rolesClaim).Msg("No roles in user claims")
return nil, errors.New("no roles in user claims")
}
```

AD FS will set `"roles":"user"` when the user is only in a single group and `"roles:["user","spaceadmin"]"` when the user is in more than one group.

We can force the array by adding an additional dummy role, but IMO we should support string values for the roles claim.