🇺🇸United States @mathieso

Thank you, mkalbere! Works nicely.

Tips for others. First, wrap the code in this so that $ is mapped to jQuery:

(function ($, Drupal) {
  "use strict";
  ...
}(jQuery, Drupal));

Second, for me, an empty Workflow menu item was still showing under Configuration. I don't know why. Add this ugly hack before the do loop in mkalbere's code:

      // Remove Workflow menu if MT.
      let workflowMenu = $("a.toolbar-icon-system-admin-config-workflow").parent();
      if (workflowMenu.length > 0) {
        // There is a Workflow menu.
        if (workflowMenu.find("ul").length === 0) {
          // No items in the Workflow menu.
          workflowMenu.remove();
        }
      }

Third, I wanted to give users with only the grader role access to the admin menu, but not the Drupal Help menu. These are in a single permission: "Use the administration pages and help". This code removes the Help menu item for those users.

      // Kill help menus for users who only have the grader role.
      let isJustGrader =
          drupalSettings.currentUserRoles.includes("authenticated")
          && drupalSettings.currentUserRoles.includes("grader")
          && drupalSettings.currentUserRoles.length === 2;
      if (isJustGrader) {
        $("a.toolbar-icon-help-main").parent().remove();
      }

drupalSettings.currentUserRoles was injected in hook_page_attachments():

  // Send user id and roles to JS.
  /** @var Drupal\skilling\SkillingCurrentUser $currentUser */
  $currentUser = \Drupal::service('skilling.skilling_current_user');
  $roles = $currentUser->id() ? $currentUser->getRoles() : [];
  $attachments['#attached']['drupalSettings']['currentUserRoles'] = $roles;

SkillingCurrentUser is a service that wraps the standard User, adding some app-specific stuff. You don't really need it.

NB: I am not an expert Drupal developer.