Spin off from #2002162: Convert form validation of users to entity validation: the definition of the roles field on user entities should use the entity_reference_field type, because it references the Role config entity.
Unfortunately this uncovers lots of bugs in entity reference handling.