WebJASPIAuthenticator ignores descriptor roles if GroupPrincipalCallback is not empty

The fix for AS7-5735 introduced a regression in the TCK tests because now the WebJASPIAuthenticator is ignoring the descriptor roles when a non-empty GroupPrincipalCallback is returned from the JASPI authentication.

The authenticator must add the descriptor roles to the set of roles retrieved from the GroupPrincipalCallback