Fix: tools: crm_resource target-role check should use meta-attribute table

Previously, check_role() searched the CIB for the uber-parent's target-role
attribute. That could give incorrect results if target-role was set on a
different resource in the ancestry chain (e.g. the resource itself for a group
member, or the group for a cloned group), or if there were multiple target-role
settings (e.g. using rules).

Now, target-role is checked in rsc->meta, which should be fully evaluated for
inheritance and rules.