Grant a role on a resource to a subject

Creates a role grant (a share) on a resource. Authorization: the caller must be an organization administrator, or hold the resource’s share permission on the target (space:share for space, spacetype:share for spacetype; settings has no share permission and is administrator-only); otherwise returns 403 forbidden. Body: subject (name exactly one of organizationMembershipId or groupId), role (role slug), resourceType (space | spacetype | settings), resourceExternalId. settings resources are created lazily (idempotent) before granting. Returns the created grant.