Add and remove role permissions in one call

Modifies the permission set of the role identified by roleId by adding and/or removing permissions in a single request. This is not a single atomic operation: the implementation reads the role's current permissions, merges the requested add/remove changes, and then writes the result back as a separate step (no transaction or rollback); concurrent calls for the same role may race, and one call's changes can be silently overwritten by another (tracked in CP-36406). Use this instead of separate add/remove calls when you need to both grant and revoke permissions in one operation; to only add permissions use POST /roles/{roleId}/permissions. Requires the tenant-id header (returns 400 if absent or blank). The request body accepts two optional arrays of permission ID strings: add (permissions to grant) and remove (permissions to revoke). Permissions in remove that are not currently assigned are silently ignored. If both add and remove include the same ID, the permission is added (remove is applied before add). Returns 200 with the complete, updated list of all permissions assigned to the role after the operation. Note: if the role does not exist, the current implementation returns 500 rather than 404 (tracked in CP-36405).