Permissions only updated on 2nd import when introducing new role splits

Problem/Motivation

Currently when we create a new Config Role Split configuration, export it, and deploy it, then it takes 2 consecutive drush cim imports for the permissions to be updated.

Steps to reproduce

1. Set up a role split and corresponding config splits.
2. Export configuration with drush cex.
3. Export config split with drush config-split:export myenv.
4. Note that we now have changes both to the exported config and to exported config split.
5. Deploy to an environment.
6. Import the configuration with drush cim.

Result: Only the config role split configuration is imported, but the permissions are not yet updated. Only when a second drush cim command is executed, the permissions are updated successfully.

Proposed resolution

This behavior is expected in some way. Config Role Split cannot update permissions if its config is not yet present. A possible solution could be to somehow trigger a second config import once the first is completed and we detect that changes have been made to the config_role_split configuration.

Another probably better solution could be to just document this behavior clearly.