Add, per Alvaro:

>
> * Implement the SQL standard mechanism whereby REVOKE ROLE revokes only
>   the privilege granted by the invoking role, and not those granted
>   by other roles