group rename breaks security roles

When a group is renamed the corresponding dynamic roles are no longer linked up correctly so authz fails for all subsequent checks

resolution is two parts:

a) validate on continuum startup that all groups have corresponding roles created, and if missing then generate them
b) on group rename update the existing roles to reflect the change