Merge "Don't require MANAGE_ROLE_HOLDERS when removing CDM associatons"