Update membership for a subaccount. Optional roles: omit the field to leave roles unchanged. Only roles for products included in the request are changed. Optional email, firstName, and/or lastName update the member; omitted fields keep the existing stored value. Email changes apply to the underlying user and propagate to connected apps via SNS (UserUpdated). Email cannot be changed for pending invitations, IdP-managed users, users who belong to other organizations, users with pending invitations elsewhere, or when the email-change rate limit applies.