This is part 1 that does the back-end:
1. New table role_allow_switch.
2. Upgrade that copies all the allows from role_allow_assign, and then drops the old CFG->allowuserswitchrolestheycantassign.
3. Old function get_assignable_roles_for_switchrole renamed to get_switchable_roles and changed to use the new table. Fixes MDL-18604 in HEAD.
4. Switch callers to use the new function name.
5. Unit tests for this new function.
6. To make those unit tests work, new switch_global_user_id and revert_global_user_id methods in UnitTestCaseUsingDatabase for toggling $USER->id.
I still need to do the editing interface under Administration ► Users ► Permissions ► Define roles. That will be done as a second commit.
MDL-17647 was referring to moodle/site:candoanything insstead of moodle/site:doanything
MDL-17648 Let get_users_by_capability take an array of capabilities, like has_any_capability
MDL-17649 get_users_by_capability must have unit tests (HEAD only).
The unit tests were briefly working (apart from the system context, which I had to set up by hand in the test contexts table). Then I made the mistake of trying to upgrade the test tables, and it all went horribly wrong (MDL-17644).
Petr Skoda