Return 400 for nonexistent user roles without partial grants

[krowvin]

Summary

• Return HTTP 400 with the missing role names and requested office when assigning roles that do not exist.
• Validate every role before granting any, so a mixed valid/invalid request cannot partially change permissions. Preserve case-insensitive role matching.
• Document the response and cover missing roles, office-specific roles, API-key authentication, and unchanged permissions after rejection.

Closes #1933

Validation

Local Java 11 gradlew build passed, including 782 service unit tests (zero failures, 40 skipped), Oracle-backed OpenAPI conversion, and generated TypeScript client checks. All 17 Oracle-backed UserManagementTestIT cases passed, including session and API-key authentication, office-specific roles, case-insensitive valid roles, and unchanged permissions after rejection.

Tested the same request against baseline and fixed local WARs with an authenticated user administrator: baseline returned 500 Database Error; fixed returned 400 Bad Request. with details.message listing both missing roles.

curl -X POST 'http://localhost:8384/cwms-data/user/m5hectest/roles/SWT' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  --data-binary '["MISSING ROLE ONE","MISSING ROLE TWO"]'

The baseline used port 8383. m5hectest is the bundled synthetic local test account; $TOKEN is its local administrator token.

• AI tools used