Preview replacing a role's permissions

Reports what replacing the role's permissions with permission_keys would change, without changing them: added and removed, and blockers, what would refuse the write, with the code and message it answers (organization.last_admin, rbac.roles_manage_below_organization); when any is listed no access is resolved. Otherwise, wherever the role is held now: holders, the identities it grants something to; identities_gaining, identities_losing and permissions, the counts per key, over everyone; and people, one page of the holders whose access changes, one row per person by name (a holder of the role at several nodes is one row), with the keys gained and lost once their other grants on each lineage are counted, via, the role at each node behind them, and pagination. The query narrows the page and never the counts: q (name or email), direction (gains or loses), permission (one key), page and take (up to 5000). People are named only for a reader who may see the Environment's people (people_named: env_identities.view in the Console, and production_identities.access in a production Environment; identity.view for an API key; access administration at the node for a tenant's administrator); anyone else gets the counts and an empty page, whatever the query. A disabled role (role_active: false) grants nothing either way. Resolved by the rules evaluate applies. Read-only. A key not in the Environment's catalog returns 404, as on the write. Send version as If-Match on the write. Requires the rbac.manage_roles permission.