Add onlyGrantWhenAdded for role.

This attribute determines whether the role should only grant privileges
when a role holder is actively added. It is optional and defaults to
false.

Fixes: 303894252
Test: RoleParserTest