New role: ANONYMOUS
Introduce a magic role which matches only if no account is currently authenticated.
[FEATURE] Introduce the magic role "Anonymous"
This introduces a second magic role (besides the
role "Everybody") which is active as long as nobody
is authenticated. This allows for designing policies
in a way that anonymous users still have access to
Also fixes a small bug in the PolicyService which
previously did not return the Everybody or Anonymous
role on getRoles().