Update User Data Collection Consent

Admin update of a user's data collection consent.

Deliberately separate from PUT /{user_id}: that route validates against UserUpdate, which requires email/first_name/last_name, and treats their presence as a profile change that gets pushed to Okta. Consent has nothing to do with either, so it gets its own single-field route — the same split the marketing-preferences routes above already use.