This adds the following tags to the config file below <role>:
* <on-failed-action>:   Action to take on auth fail
* <on-failed-argument>: Argument for action on auth fail
* <on-deny-action>:     Action to take on acl deny
* <on-deny-argument>:   Argument for action on acl deny

All client alter actions are supported. The corresponding
auth does not need to have the permission for those operations.

Notes:
    Likely <on-deny-*> should be moved below <acl>, See: #2351

Closes: #1272