Update chat access

Replaces the access policy. Send the complete policy: groups and members not listed lose their access. Use mode "everyone" to give every organization member accessLevel (plus any listed groupAccess/memberAccess), or mode "restricted" so only the listed groups and members, the creator and organization admins can access it; restricting removes the default everyone access. groupAccess and memberAccess are required (send [] for none), and listing one principal twice with different levels is rejected. The GET response can be sent back unchanged, and sending the current policy again changes nothing. View-only members are capped at VIEW whatever their grant. The chat creator cannot be listed in memberAccess. Requires manage access to the chat.