Enforces that if a runAsRole is present, then the role to check must be the same as that runAsRole and the set of static roles is ignored.