Fix user roles and owner permission checks

[aldeed]

Resolves #6002
Impact: minor
Type: bugfix

Issue

• addAccountToGroup mutation doesn't properly handle user doc that has no roles property
• check for global ownership in createAccount isn't awaited and is therefore always truthy
• When account.shopId is null, which is usually the case now in 3.0.0 release, an account was not initially added to any groups.

Solution

• addAccountToGroup mutation will not fail if user.roles array is missing
• check for global ownership in createAccount is awaited so only the first user created will end up in the "owner" group
• When account.shopId is null and a primary shop exists, the account is associated with the correct group for the primary shop

Additionally removed addRolesToGroups support for registerPlugin config, which is no longer needed. The roles list is currently stored in the reaction-admin app for all plugins. This will be implemented in a better way with the new authorization service.

Breaking changes

If your plugin passes addRolesToGroups option to registerPlugin, it's now ignored.

Testing

I suggest just code review plus testing the basic user reg/login/logout flows in conjunction with testing reactioncommerce/reaction-admin#171

[mikemurray]

👍