List the principals holding a role in the active scope

Returns the roster backing the role detail page "Assignments" tab: every principal (user or service account) granted this role at a scope covering the active scope — an assignment targeting this project directly (scopeKind=project) or the subscription above it (scopeKind=subscription). Each row carries the principal id, display name, principal type (user|service-account), the scope kind + human label the grant targets, and the grant timestamp (grantedAt). Principals whose user/service-account record is not visible in the active tenant are omitted, so the roster stays tenant-scoped. Validation: scopeId must reference a scope the caller can access (unknown → 404 NOT_FOUND); page/pageSize must be positive integers (else 422 VALIDATION_FAILED); the caller needs at least reader on IAM in the scope (else 403 FORBIDDEN). Async & state: Synchronous read; no state change; no SSE frames emitted. Errors: 401 missing/expired session; 403 caller lacks IAM read permission; 404 scope not found or not visible; 422 malformed query parameters; 500 read-model unavailable. Idempotency/Concurrency: Safe, cacheable; no idempotency key required.