Add "masquerade as @role" permissions/settings for each role

Already started working on the patch for this, but essentially I want to prevent certain users that have access to "masquerade" from switching to roles with higher privileges than they may currently have. The best way to accomplish this--as I understand now, is to restrict which roles each role is allowed to "masquerade as".

Would like some feedback on this as well.