Update a global policy in a project

Updates the named global policy from the supplied policy snapshot JSON (the '_class' discriminator selects the concrete policy type, which must match the existing policy's type). The existing record's id, projectId and global flag are preserved. Every proxy/policy-group that embeds this policy is updated to match (same cascade as the classic global policy update) — embedded snapshots would otherwise go stale. Secret (@SecretData) fields are PLAINTEXT in the request and are encrypted before persist — same contract as the classic per-type policy update. MCP Tool Call/Invoke and A2A Agent Call/Invoke policies are updated like the policy screen: an absent inline server block or secret keeps the stored one, and tool/skill catalog, pin, health and drift fields in the body are ignored. The update goes through the policy type's own service and gets that service's checks (a rejected policy returns 400); the few types without such a service keep the generic path. An AI policy needs the AI Development permission, the others API Management.