Keycloak also allow to define user roles at realm level to define
permissions at a global level not tight to a client.
Include these extra roles in the user permissions set from the
decoded token content.
As a consequence, some parameters of the `keycloak_oidc_factory`
function got renamed, this will break `swh-deposit` tests but
I will push a diff to fix that.
Related to T3213