Update a group mapping

Updates a group mapping. role_ids REPLACES the mapped role when present — at most one role, since a member holds exactly one (two or more answers 400 role_cardinality). Members lose the old mapped role on their next recompute; manually assigned roles are untouched and always win. Requires sso:manage, and — because a mapping is a deferred grant applied with no actor present — you may only map a role whose permissions you hold yourself. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers 428 step_up_required). An organization API token is not challenged.