Produits Entr'ouvert » w.c.s. » Au quotidien

saml2: add extraction of roles from assertions

- Accept syntax xxx::yyy::role name
- Allows to select on a prefix
- Create new ones
- Set allows_backoffice_access attribute if the role path contains
backoffice as penultimate part.
- Special role named « Admin » set is_admin=True on the user