Implement ACL create/drop_role functions

Part of #280 (closed)

This patch provides the second group of ACL functions (see #280 (comment 32687)):

• Add pico.create_role()
• Add pico.drop_role()
• Update pico.grant_privilege() and pico.revoke_privilege(). Now they take grantee — a user or a role name.