Conditionally add entity role whitelist filter

The Shibboleth UI does not mark/enforce adding an EntityRoleWhitelist to a metadata provider as "required", but if you do not add one, the backend writes out an empty  EntityRoleWhitelist filter into the resultant metadata-providers file (whether written to disk or obtained from the end point.) And an  empty  EntityRoleWhitelist filter effectively filters out all entities, leaving no entities at all from the aggregate. The best solution is to only write out the  EntityRoleWhitelist filter when the user has selected one or more roles for that whitelist, and never write out an empty one.

p.s. The alternate solution would be for the front end to mark slecting one or more roles for an  EntityRoleWhitelist filter as required, and force the user to do so before saving the provider.