skip-roles

Add a front matter options `on.skip-roles: [...]` that allows to skip a workflow for particular roles. For example, in AI moderation scenario, certain check do not need to be applied to team members, only external users need to have it checked.

```
on:
  skip-roles: [admin, maintainer, write]
```

The check should be done in `pre-activation` and cleanly cancel `activation`. 