Function added_acl_roles 

pub fn added_acl_roles(
    before: (RoleIdentity, Option<&[ObjectAclEntry]>),
    after: (RoleIdentity, Option<&[ObjectAclEntry]>),
    roles: &BTreeMap<String, RoleDefinition>,
    object_kind: &str,
    added: &mut BTreeSet<String>,
) -> Result<(), SQLError>

Record the names of roles that an ACL change newly references, excluding the owners.