Replace a SharePoint connection's site policy

Replace a SharePoint connection's WHOLE site policy.

Whole-set, never a delta: a policy is the complete answer to "which sites may Patricia address through this connection", so the request that sets it says the whole answer. A delta protocol could be made concurrency-safe too, with its own removal grammar; this one is simply the shape that needs no such grammar, and the version check below is what makes it safe.

expected_policy_version is the compare-and-set guard, and omitting it is an EXPECTATION rather than a bypass — it means "I read no policy", so against a connection that already has one the write is refused. That is the direction that cannot silently discard somebody's choice.

Only sites are sent. The stored policy also names the drives under them, and those are enumerated server-side from the selection rather than accepted here: a drive -> site pair is what admits a call rooted at a drive, so a client able to state one could name a drive under a site it holds and reach a library on a site it does not. The read still returns the pairs, which is what makes the stored policy inspectable.

One connection's policy, and the version the next write has to send back.

policy_version is None when no policy row exists, which is the expect-absent case rather than version zero — an editor has to be able to say "I read no policy" and have that be checkable against the row that does or does not appear.

owner_authored is what makes a row a grant. A row written by the connection-landing insert carries false here: it records that the connection exists, never that anybody chose its policy, and the authorizer reads that rather than mode_code.