Issue #2825927: Add an option to end the session instead of removing a role

Add a role_ip_behavior setting to the role settings form, chosen with radio options: remove (the existing behavior, which drops the out-of-range role for the request) or end_session (which signs the user out and shows a message). Ending the session reuses the login firewall logout, clearing the session so the warning survives to the destination page, and only fires when the user actually holds a restricted role.

Closes #2825927