Administrator Entitlement URI is only set at account creation timde

When a value is set for “Administrator Entitlement URI”, it is only taken into account at account creation time.
If the entitlement changes later, the role is not being updated.
This is counter intuitive, and also poses a slight security risk.
When we rely on eduPersonEntitlement for assigning roles, we should also update the role when the attribute changes.