Upsert roles at the core and group-location level

Updates the practitioner's roles at the core practitioner level and, optionally, at the group-practitioner-location level. Each role entry in the request is upserted — added if not present, updated if already present; roles are not deleted by omission, so to remove a role use PATCH /practitioners/{id}/roles/remove instead. Use this when adding or modifying practitioner roles; for renaming a role key as a data correction, use PATCH /practitioners/{id}/roles/correct. {id} is the certifyPractitionerId. Each entry requires role (validated against a runtime role allowlist) and at least one of effectiveDate/terminationDate; groupPractitionerLocationId is optional and controls whether the entry is also applied at the location level — if omitted, only the core practitioner record is updated.