[feature] Implement Mastodon-compatible roles (#3136)

* Implement Mastodon-compatible roles

- `Account.role` should only be available through verify_credentials for checking current user's permissions
- `Account.role` now carries a Mastodon-compatible permissions bitmap and a marker for whether it should be shown to the public
- `Account.roles` added for *public* display roles (undocumented but stable since Mastodon 4.1)
- Web template now uses only public display roles (no user-visible change here, we already special-cased the `user` role)

* Handle verify_credentials case for default role

* Update JSON exact-match tests

* Address review comments

* Add blocks bit to admin permissions bitmap

web/template/profile.tmpl

@@ -173,9 +173,11 @@
                     <dt class="sr-only">Username</dt>
                     <dd class="username text-cutoff">@{{- .account.Username -}}@{{- .instance.AccountDomain -}}</dd>
                 </div>
-                {{- if and (.account.Role) (ne .account.Role.Name "user") }}
+                {{- if .account.Roles }}
                 <dt class="sr-only">Role</dt>
-                <dd class="role {{ .account.Role.Name -}}">{{- .account.Role.Name -}}</dd>
+                {{- range .account.Roles }}
+                <dd class="role {{ .Name -}}">{{- .Name -}}</dd>
+                {{- end }}
                 {{- end }}
             </dl>
         </div>