Allow specifying existing roles/bindings as input

[liggitt]

only generate roles for permissions missing from existing roles

[jhliptak]

This would make adding permissions easier. If the log files have rolled over you basically have to tear down your environment and re-create it to get permissions.