Node grants are not updated when role permission is changed

Currently, node grants are not updated into a role being granted the module's permission. This means that unpublished nodes will have incorrect node access for that role until the next node_save() or other update. At a minimum, changing the module configuration needs to flag node access for rebuild; ideally, TAC's affected nodes API would be used instead.