Add an off switch for revoking permissions in the built-in role sync #1430

Tracking item for #1426 (requested in review, may land inside that PR). Once the sync becomes authoritative, any host that registers IdentityModule without every other module would revoke the missing modules' permissions from Admin in every tenant on startup.

Guards:

• skip removal when a role's target set is empty
• Identity:PermissionSync:RemoveRevoked (default true) to turn removal off for partial hosts
• document both in the docs authorization page

Close this when #1426 merges with the guards.