Cannot assign roles creating User through REST endpoint
For other people reaching this post, the answer to this is to use some kind of authentication on the REST endpoint, that only allows trusted users to create new users.

Otherwise anonymous users would be able to create admins and crash the site.

So this code is correct,

"roles": [
  "5",
  "6"
]


but the problem is that the user calling the endpoint has to have the administer permissions and administer users permission to be able to set roles to users.

That can be done by setting a role that has those permissions and also has permission to call the endpoint.

oAuth could be used to do that.