Set per-role contact assignments for the form's connection

Form-scoped equivalent of PUT /v1/merchants/:merchantId/connections/:connectionId/contact-roles. Possession of a non-expired form id authorizes this mutation — same pattern as every other mid-flow endpoint on this controller. For multi-connection forms, the connectionId query parameter is required; for single-connection forms it defaults to the form's connectionId.