[D7] Add setting for which roles can be assigned

Description of the need

The ability to assign roles was added to core in backdrop, replacing the need for the Assign roles module.

In Drupal 7, the "assign roles" module had a setting to define which roles could be assigned. This made it possible to grant someone the permission to Assign roles without allowing themselves to increase their own role beyond what was indented.

I would love to see this setting in Backdrop, with the Administrative role initially excluded. This would make for a safer set-up out-of-the box.

Proposed solution

Add a setting for roles that are allowed to be assigned.

Alternatives that have been considered

Port the assign roles module, and have it include only the setting (since the feature has been added to core)

Additional information

We initially created this as a security issue, since it has security implications. However, since the permission is no more dangerous than "Administer users" -- which was the only way people could assign roles before this feature was added, we decided to move the PR to the public queue for more reviews.