fromClaim
Reads roles from a string or list-of-strings claim named claimName, converting each value to a RouteRole via roleOf.
A String claim is treated as a single role name; a Collection<*> uses each element's toString(). An absent or unrecognized claim yields an empty set. Names for which roleOf returns null are dropped.