Update a user's organization access and/or group-level role, identified by email. The organizations array uses replace-semantics (send the full desired set); name each organization either by its Popp organizationId or by your own externalOrganizationId (exactly one per entry).