Allow users with administer users to see Roles tab via a setting

Thanks for the work! We also ran into the issue and this looks good but would also like to have update hook set to yes to avoid the regression.

Added a patch from the merge-request with the changes:
- autowiring the access_check.role_delegation service (not sure if we wanted to set default to true for all).
- Set update hook setting to TRUE to avoid regression for existing sites.

But main reason for adding the patch is because I need a static patch file that I can use instead of a merge request that can change.