Add ability to negate Role Assign selection

Setting to Needs work because we'll need tests cases to test the negate setting

Created a branch and MR against the 2.0.x branch.

The last patch did not apply to 2.0.x so cherry picked the changes, and fixed a couple minor things (like using boolean in the schema instead of integer for the negate setting).

I"ve also added some basic test assertions to validate it, but also tested locally.