Once a new capability has been created via access.php the role assignments related to it cannot be altered by changing access.php (because the role assignments may have been changed by a site admin by that point, so it is not safe to automatically change them).
So, if an earlier version of access.php allowed the capability for a wide range of roles, then they will still have that capability, even after changing access.php + version.php.
One way to reset the capability definitions is to uninstall the plugin via the UI, then let it automatically reinstall - but this only works if you don't mind deleting all data for the plugin (so, only really useful if you're early in the development and don't have any production data to worry about). You might want to try your plugin against a clean install of Moodle to see if that gets the capability assigned to the expected roles.
As for the capability name, in the language file, you should put:
$string['widget:upload'] = 'Upload';