Add RoleBehavior.grant()/revoke().

Some roles (e.g. notification assistant) need to grant/revoke specific
privileges, so let them customize that with RoleBehavior.

Bug: 110557011
Test: manual
Change-Id: I39dc2ea462fec09501c811c9aebb9d18f7a2af4d