Add backward-compatible gates

Like Tempest, Patrole should be used to verify that RBAC is properly enforced not just for the latest release ("N") but also N-1 and N-2. Currently, "N" is Pike, so gates should be added for Ocata and Newton.

While it is better to add a gate per role -- for a sum total of 4 additional gates -- this is rather resource intensive, so it might be better from a practical standpoint to just add an Ocata and Newton gate for the Member role, because Member is more restrictive and therefore more likely to break than admin.