fix(rbac): make updateRole atomic via dataSource.transaction (#1050)

[Chrisland58]

• Inject DataSource into RolesService
• Wrap updateRole in dataSource.transaction() so name update and permission reassignment commit or roll back together
• Acquire PESSIMISTIC_WRITE row lock at the start of the transaction so concurrent updates to the same role serialize
• Throw NotFoundException inside the transaction (before any writes) when the role does not exist
• Move audit log writes to after the transaction commits so they are never recorded for rolled-back mutations
• Add four new unit tests (Issue Make RolesService.updateRole atomic across the name update and permission reassignment #1050):
  • rolls back name change when permission set throws
  • no audit written on NotFoundException inside tx
  • single dataSource.transaction call wraps all writes
  • audit written only after transaction commits

Closes #1050

[drips-wave]

@Chrisland58 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Well done on the job done so far!
Kindly resolve conflict and fix workflow to pass.