Add default/fallback holders and implement grantDefaultRoles().

Default role holders are the ones that will be added when the role is
added to the system for the first time, and a fallback role holder is
the role holder that will get added when all holders of the role are
removed. Default/fallback role holders are controlled by RoleBehavior.

In order to enforce these two new concepts, remove/clearRoleHolder()
is made to trying adding the fallback role holder, and
grantDefaultRoles() is also implemented. This default role granting
follows the following logic:

1. Re-grant privileges if a current role holder still qualifies, or
remove it if it doesn't.

2. Try adding default/fallback role holders if there are no role
holders now, depending on whether the role is added for the first
time.

3. Retain only the first role holder if an exclusive role has multiple
role holders.

Bug: 110557011
Bug: 122730135
Test: build
Change-Id: I18a88efe6de844fb875271f1b3c4c1b6ff050c37