Keep default services enabled when enabling a GEO role

This adds support for roles specifing whether they manage services or not.

Roles that manage services cause the Default Role to be disabled when they are in use.

Roles that do not manage services, like our current Geo roles, don't cause the Default Role to be disabled.

Roles default to 'managing_services'

Fixes: #2818 (closed)