Update Consent settings

Omitted fields retain their values. trustedOrigins replaces the complete allowed-origin list and must contain at least one entry; use the projects API for website changes. Session duration and branding remain subject to shared plan checks. minimumC15tMajor 3 makes the project refuse requests from c15t 2.x sites with 409, so check c15tV2HoursLast7Days first; it requires rollout-c15t-minimum-version. Both values require an Instance on c15t 2.x or later; setting 2 does not need the rollout. Requires consent.write, projects.read and projects.write, with an admin or owner role. New public writes require rollout-agent-access-writes, default false. Organization API keys cannot call this operation.