accesslib: drop rdef mangling for default role - check in has_cap_fad()

accesslib: drop rdef mangling for default role - check in has_cap_fad()

There are some exceptions when checking for caps that are inherited
from the default role. Move the check into has_cap_fad() and stop
mangling the data we put in $ad[rdef].

We now also set $ad[dr] to record default roles added.

This will later allow us to share rdef across many users in $ACCESS.

Affects:
  load_user_accessdata()
  has_cap_fad()

While at it, document has_cap_fad() a bit.