Role based user list

The use case that you mentioned does not match your original question. Not displaying the testers (when in Resolved status) does not prevent a developer from assign the defect to "someone". You may consider locking the attribute (read-only) instead.

In terms of getting a user list based on roles, I don't think you can do it in Attribute Customization as the JavaScript functionality is quite limited there.

It should be doable with Java API.

I would recommend creating a separate task for a tester, or for a lighter weight approach, an approval for the tester, rather than trying to hand the ownership of a single task from one role to another.