RoleAccessCheck returns Allowed if user has no role

Problem/Motivation

In \Drupal\user\Access\RoleAccessCheck if the user has no roles

Which is hypothetical scenario, confirmed with Security team that, it would never happen in real life.

A user will at least have an anonymous role at minimum.

However, with testing if we have a user without a role following code in the class would return empty diff and user will be allowed in.

$diff = array_diff($explode_and, $account->getRoles());
      if (empty($diff)) {
        return AccessResult::allowed()->addCacheContexts(['user.roles']);
      }

Steps to reproduce

It is not possible to re-produce with a Drupal setup, but only in tests.

To Reproduce:
- In \Drupal\Tests\Core\Route\RoleAccessCheckTest
- Add a user with no role
- Add a test of user with no role should not get in
- The test will fail.

Proposed resolution

We should tighten up the check that if the role is not there, we return AccessNeutral

Remaining tasks

- Add a patch
- Modify \Drupal\Tests\Core\Route\RoleAccessCheckTest test

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet

Update tests and tighten RoleAccessCheck