Fix validity data on business roles

Release 15.17.0 fixed a situation where sub roles shared by multiple automatic (business) roles sometimes did not update their validity after a contract change. See redmine #40570.

• Warning: the fix prevents new inconsistencies from being created, but it does not repair existing incorrect validities of sub roles in the data.
• Use the detection SQL to determine the impact on the project, and use the repair SQL (PostgreSQL) to fix it. Run the repair repeatedly until it updates 0 rows.

Number of affected users + logins:

SELECT COUNT(DISTINCT i.username), string_agg(DISTINCT i.username, ',') AS loginy
FROM idm_identity_role ir
JOIN idm_identity_contract ic ON ic.id = ir.identity_contract_id
JOIN idm_identity i ON i.id = ic.identity_id
JOIN idm_identity_role direct ON direct.id = ir.direct_role_id
WHERE ir.direct_role_id IS NOT NULL
  AND (
    (ir.valid_till != direct.valid_till OR ir.valid_from != direct.valid_from)
    OR (ir.valid_till IS NOT NULL AND direct.valid_till IS NULL)
    OR (ir.valid_from IS NOT NULL AND direct.valid_from IS NULL)
    OR (ir.valid_till IS NULL AND direct.valid_till IS NOT NULL)
    OR (ir.valid_from IS NULL AND direct.valid_from IS NOT NULL)
  );

Repeat until 0 rows are updated:

UPDATE idm_identity_role AS ir
SET valid_from = direct.valid_from,
    valid_till = direct.valid_till,
    modified = now()
FROM idm_identity_role AS direct
WHERE direct.id = ir.direct_role_id
  AND ir.direct_role_id IS NOT NULL
  AND (
    (ir.valid_till != direct.valid_till OR ir.valid_from != direct.valid_from)
    OR (ir.valid_till IS NOT NULL AND direct.valid_till IS NULL)
    OR (ir.valid_from IS NOT NULL AND direct.valid_from IS NULL)
    OR (ir.valid_till IS NULL AND direct.valid_till IS NOT NULL)
    OR (ir.valid_from IS NULL AND direct.valid_from IS NOT NULL)
  );