ConfirmNoEscalation determines if the roles for a given user in a given namespace encompass the provided role.

Covers determines whether or not the ownerRules cover the servantRules in terms of allowed actions.

NewTestRuleResolver returns a rule resolver from lists of role objects.