Security\Context::getRoles() currently returns an array of (expanded) Role instances.

It is used all over the place even though:

• in most places we're only interested in the identifier of the expanded roles, not about the (mutable) Role instances
• arrays in APIs are bad because types.. :)

To make this a b/c change, I would suggest to introduce the additional methods:

class Context {


  /**
   * consider using {@see self::getExpandedRoleIdentifiers()} instead
   */
  public function getRoles(): array {
    // ...
  }

  public function getExpandedRoleIdentifiers(): RoleIdentifiers {
    // ...
  }
}

Also the RoleIds could have some static constructor like:

final readonly class RoleIds {
  // ...
  public static function forAnonymousUser(): self
  {
    return new self('Neos.Flow:Everybody', 'Neos.Flow:Anonymous');
  }
}

to centralize this piece of magic