feat(cloud): manage organization custom roles

[sdairs]

Organization role IDs were required by member, invitation, and API-key commands, but the CLI could neither discover nor manage those roles. This adds cloud org role list|get|create|update|delete over the five existing GA API methods.

Create and update accept the complete typed role request as a JSON file or stdin, including actors, multiple policies, ALLOW/DENY, resources, permissions, grants, and roleV2 tags. Input rejects unknown fields at every nesting level and rejects unknown enum values before HTTP. Updates are partial: omitted fields stay unchanged, while supplied actor and policy arrays replace their complete lists. List/get support OAuth; writes fail fast unless API-key authentication is active. Human output preserves the system/custom distinction and tolerates sparse responses, while JSON output returns the typed API data.

The README now documents role discovery and a complete nested custom-role workflow, and member/invitation/key help points to cloud org role list for role IDs.

Validation:

• cargo fmt --all
• cargo clippy -p clickhousectl -- -D warnings
• cargo check -p clickhousectl --no-default-features
• cargo clippy -p clickhousectl --all-targets --no-default-features -- -D warnings
• cargo test -p clickhousectl

Closes #577.

[iskakaushik]

LGTM