RBAC grant

Assign a Fabric workspace role to a user, group, or service principal. The Principal ID must be the Entra objectId — UPN lookup is planned for v1.1.