Edit (replace) a security rule

Replaces rule securityRuleId of a security group with the rule in the body — the "Edit rule" action of the detail view's rule tables. Neutron security group rules are immutable, so the edit is performed server-side as one workflow. For a change of direction/protocol/ports/remote the edited rule is ADDED first and the old rule is then removed, so the traffic the old rule allowed has no window with neither rule in place; if that removal fails both rules stay (both are listed) and the operation ends FAILED. When the provider reports the add as the very rule being edited (Neutron's duplicate check ignores the description) that rule is never removed by the add step. A description-only change is applied by recreating the rule (remove, then add with the new description — a brief gap without the rule); if the recreate fails the old rule is restored and the operation ends FAILED. Validation: the same field rules as adding a rule (direction, etherType, protocol, port range and exactly one remote source) → 422 VALIDATION_FAILED; the parent security group must exist in the scope and be visible to the caller → 404 NOT_FOUND; securityRuleId must reference a rule of that group → 404 NOT_FOUND; contributor or higher → 403 FORBIDDEN. Async & state: Asynchronous — returns 202 with an Operation; the group's rule list carries the edited rule (at the old rule's position, keyed by the provider rule id) once the operation SUCCEEDS. resource.updated SSE frames are emitted for the parent security-group resource. Errors: 401 unauthenticated; 403 caller lacks write rights; 404 unknown group or rule; 412 when If-Match is supplied and stale; 422 invalid rule; 500 on workflow errors. Idempotency/Concurrency: Idempotency-Key is optional; replaying the same key returns the original 202 Operation. If-Match with the parent group's ETag guards against editing a rule of a group that changed since it was read.