Replace the member's editable access rows

Makes the member's rows the caller may edit equal access, in one transaction. Rows the caller cannot edit (outside its reach, or without authority at their target) are outside the diff and always kept; a desired row identical to one of them is a no-op. The same normalization as the invite applies (dropped); the rows taken away are returned in removed. access: [] removes every editable row -- the member stays a member. Rows are checked at their OWN target exactly as on the invite (POST /tenants/{tenantId}/iam/users): 404 SCOPE_NOT_FOUND; 403 INSUFFICIENT_ROLE_FOR_SCOPE / CANNOT_GRANT_ABOVE_OWN / TENANT_OWNER_REQUIRED; 422 ROLE_NOT_FOUND / ROLE_NOT_ASSIGNABLE_AT_SCOPE; precedence 404 > 403 > 422 with details.errors[{index, field, code, message}]. 409 details.reason: LAST_TENANT_OWNER (the change would leave the tenant without an owner) or SELF_IAM_MANAGE_REMOVAL (the caller would remove one of its own rows that confers iam: manage). Every added / removed row is one iam.user.access.grant / iam.user.access.revoke Activity Log record and re-projects the member's OpenStack roles. The answer is the full matrix after the change.

Step-up: granting an owner-ranked role (built-in owner, or a custom role that ranks as owner) from a console session whose account has two-factor authentication needs the factor verified in the last 5 minutes, otherwise 403 MFA_STEP_UP_REQUIRED (verify with POST /auth/step-up, then retry). Other roles, and an owner row the member already holds, are not affected.