Currently user_roles is a weird bridge between the list of available roles (which is configuration) and the user (which is an entity). I suggest we move a user's role assignments to the user entity as a default field. This implementation would be similar to the one I proposed for path aliases in #1751210: Convert URL alias form element into a field and field widget.
- Add a multi-instance text field to the user entity, which has a select list of available roles (which will be stored in CMI).
- Set this field to be Format: Hidden by default in all view modes
In the aliases issue I suggested saving the aliases out to denormalized storage for the purposes of performant reading, but I'm not sure that is necessary here.