Assign a member's role

A built-in role (owner, admin, member), a template key or a role id. Only an owner assigns or removes owner; nobody changes someone wider than themselves. A member whose role was changed several times in a row may be refused with 429 rate_limited for a few seconds; nothing was changed, so retry after Retry-After. A change the identity provider refuses answers 409 conflict with details.reason role_change_refused; nothing was changed. A role naming a member's personal mailbox goes to that member only: otherwise 403 grant_forbidden with details.reason personal_mailbox_member_only. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose roles.write (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.