fix: drop the implicit ROLE_USER from the userinfo roles claim

tests/Security/RoleTest.php

@@ -38,6 +38,15 @@ class RoleTest extends TestCase
         self::assertSame([Role::CUSTOMER], Role::filterImportable([]));
     }
 
+    public function testAssignedOnlyDropsTheImplicitRoleUser(): void
+    {
+        $roles = Role::assignedOnly([Role::USER, Role::TEAMER, Role::GROUPS_ADMIN]);
+
+        self::assertSame([Role::TEAMER, Role::GROUPS_ADMIN], $roles);
+        // The value is JSON-encoded into the userinfo response and must not become an object.
+        self::assertSame(array_keys($roles), range(0, \count($roles) - 1));
+    }
+
     public function testCombineKeepsEachHalfInItsOwnLane(): void
     {
         $roles = Role::combine([Role::TEAMER, Role::ADMIN], [Role::GROUPS_ADMIN, Role::TEAMER]);