Patch a SCIM user

Applies partial modifications (RFC 7644 §3.5.2).

Behavior & limitations:

• Removing the required userName returns 400.
• active: false deletes the user.
• emails / displayName are not mutable.
• roles[].value must be a numeric profile id (a non-numeric value is silently ignored).
• Supply If-Match for optimistic concurrency; a stale value returns 412.