CVE-2026-55163: Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>

The PUT /api/1/roles/<id> handler in lemur/roles/views.py gates only on RoleMemberPermission(role_id).can(), which is satisfied for any user who is already a member of the target role. The handler then passes data["users"] and data["name"] directly to service.update(), permitting any role member to rewrite that role’s membership list and name. The companion DELETE handler on the same resource is correctly gated by @admin_permission.require; the asymmetry between PUT and DELETE on identical resources indicates an authorization oversight rather than a deliberate design choice.