Provide an api to get all effective roles for a user

The current v3 api specification includes an api for getting all roles for a user:

GET /users/{user_id}/roles

with the response actually being a list of role assignments (rather than just roles). Although this is part of the v3 spec, it is not actually implemented in Grizzly (it always returns an error). We should re-define (and implement) this api so that it is clear it is indeed for getting the effective role assignments that exist for a given user, whether these roles are directly assigned, by virtue of group membership or inherited from the parent domain.