Applies one change (requestable and/or workflow) to up to 1,000 roles given by ID, in a single call.

Intended flow: read the roles to change with GET /public/v1/roles and its filters, decide which ones need the change, then send only those IDs here. The endpoint has no filters, so it only ever touches the IDs you list. Group roles that need the same change into one call, and split larger sets into calls of at most 1,000 IDs.

Validation is all-or-nothing: if any ID does not exist in the tenant (404) or the caller is not allowed to edit it (403), the whole request is rejected, the offending IDs are listed in params.ids, and nothing is applied.

The update runs asynchronously. The response is 202 with a jobId and the number of roles queued. Poll GET /public/v1/bulkOperations/{jobId} until status is completed or failed.

Bulk operations run one at a time per tenant. While one is queued or running, this endpoint returns 409; wait for the running operation to finish and retry.