Assign Bulk Browse

Assign the catalog browse/list roles (sample_ro_list_role and bulk_ro_list_role) to the principal.

Called by CAMS at block-enable. Tolerant per role: if a role isn't seeded in this environment, logs a warning and reports assigned=False for it (HTTP 200). These are list-only roles — they grant catalog browsing, never data read (which stays per-SKU default-deny).