Add support for hierarchical roles to the local authorizer

We should update the local authorizer so that role values for role-based actions matching whole role subhierarchies are understood, e.g., given roles a/b/c, a/b/d and a/e it should be possible to specify a role value a/b/% matching actions on roles a/b/c and a/b/d, or a value a/% matching actions on all above roles.