app-shell: Add a required_roles field to the activity metadata

This field specifies a list of roles that the logged-in user needs to
have to interact with this activity.

In the case of the app-shell this means the activity is hidden until
the user information is loaded after login.