The following patch *should* work for 10.3.0, but I have not run it through the full test suite, just did local Functional, Kernel and unit tests for content_translation. The key item in re-rolling was accounting for issue #3112298, which replaced REQUEST_TIME in the created form item.
I am going to jump on the me too boat here, but mine might be a different use case. We are actually seeing any users with the `assign XXX role` permission lose all their roles upon logging in. We do have simplesamlphp_auth, which I believe saves the user on each login.
The only odd thing is, about a year+ ago when we first updated the module, we found if we cleared the cache and regranted users the deleted roles they would keep them for a period of time until they got removed again. We were updating to 9.4 and bumped all modules and could not reproduce in dev, so we only updated what was needed. We found that we needed a certain amount of user traffic logging in before it would remove the roles. I assumed it might have been a memcache issue or something in Simplesamlphp_auth.
Accidentally left in old use statement from previous patch.
Previous patch hardcoded the table name and used $this->connection->query. For some reason this broke a large number of tests. Using static::TABLE_NAME and $this->connection->insert does not seem to throw errors. Let's see if we can get a good build.
Re-rolling after PHPCS changes.