Edit a custom role

Updates a custom role's display name, description, assignable scope levels and/or permission matrix ("Edit" / "Edit role" in the Roles page and the role detail page; also exposed as a bulk action on selected rows). Built-in roles are managed and immutable. Changes to the permission matrix affect every principal currently assigned the role; the resulting state is available to subsequent reads. Validation: role must exist and be visible (else 404 NOT_FOUND); builtIn: true roles reject any update with 409 LOCKED; if name is supplied it must remain unique in the tenant; permissions keys must be known resource keys with values manage|read|none and assignableScopes entries subscription|project — violations → 422 VALIDATION_FAILED. Async & state: Synchronous. Every edit — name, description, assignable scopes and the permission matrix alike — is applied inline and returns 200 with the updated RoleDef. A permission-matrix change additionally stages the OpenStack re-projection of every holder in the same transaction; it runs after the response and is not tracked by an Operation here (the edit is recorded as an already-SUCCEEDED iam.role.update Operation in the activity feed). Errors: 401 unauthenticated; 403 when the caller lacks iam:manage; 404 unknown role; 409 LOCKED when targeting a built-in role; 422 for invalid fields; 500 on internal failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. A repeated identical PATCH applies the same fields again (same end state) and returns 200 with the role; each call records another iam.role.update audit Operation and, when permissions is sent, stages another OpenStack re-projection. This operation does not check If-Match; a sent one is ignored and the last write wins.