[keyserver] Prevent updateRoles from resetting user-surfaced permissions

Summary:
This resolves ENG-9031.

updateRoles currently resets user-surfaced permissions to the default. This diff instead attempts to reconstruct the set of user-surfaced permissions based on the current role permissions, and then reapply then when generating the updated permissions.

Depends on D13074

Test Plan:
I tested this in combination with the next diff, where we add a updateRolesAndPermissionsForAllThreads migration:

• Create a community
• Update Members permission to include managing tags
• Run the migration
• Confirm that the managing tags permissions is still present

Reviewers: tomek, inka

Reviewed By: tomek

Differential Revision: https://phab.comm.dev/D13075