Role and permission metadata (Catalog API)

[BryanttV]

Description

• Endpoints to extend/create (mapping directly to the document's contract):
  • List roles available in an existing scope (GET /api/authz/v1/roles/?scope=<scope>)
• Data source: these endpoints must read directly from the loaded definitions, not maintain a parallel copy.
• Response format: design the JSON response with the Administrative Console as the direct consumer — it likely makes sense to align the response shape with the fields defined in the ADR.

Proposed ADR: #425

Concrete deliverable: a client (including the Admin Console) can retrieve all the information needed to list and describe a scope's roles/permissions without knowing in advance which ones exist.