Dump all roles first, then all config settings on roles.

This way, if a role's config setting uses the name of another role,
the validity of the dump isn't dependent on the order in which those
two roles are dumped.

Code by Phil Sorber, comment by me.