Replaces the integration's repo allow/deny scan policy. An allow policy with an empty fullNames is stored faithfully (scan nothing), not coerced to scan-everything. Duplicate names collapse to one. Returns 422 (not_scannable_integration) for non-scannable integration types.