Do not leak role paths in case no metadata is set

Structure on an installed collection and installed role now always contains the field location, set to null by default`.

For scans with --exclude-metadata switch enabled, the value is now set to null even when it is known locally.