Enable OIDC group-based role mapping for Developer Portal consumer organizations

API Connect already supports LDAP group-to-role mapping for Cloud Manager and API Manager roles, but IBM's own documentation confirms this cannot be applied to Developer Portal users. There's no OIDC equivalent either: an OIDC user registry can authenticate and onboard Developer Portal users, but there's no way to derive a consumer organization member's role (Administrator, Developer, Viewer) from a group or role claim in the ID token. Today every consumer-org member's role has to be set manually, one at a time, via the Portal's Invite UI or by calling member-invitations:create --scope consumer-org with an explicit role_urls value.

This matters for any provider organization that centralizes identity and group management in an external IdP (Azure AD/Entra ID, Okta, Ping, etc.) and wants Developer Portal role assignment to follow that existing group structure, the same way they manage access everywhere else. It's most painful for large partner/developer ecosystems, where manual role assignment doesn't scale and creates a lag between an IdP-side change someone moving teams or leaving  and their actual access in the Portal.

Requested behavior: extend the existing role-mapping model to consumer organization roles, so a Developer Portal role can be automatically derived from a configurable claim (e.g. groups or roles) in the OIDC ID token / userinfo response, evaluated at onboarding and re-evaluated on later logins if group membership changes — mirroring how LDAP group mapping already works for provider-org roles. Exposing this via the toolkit CLI/REST API first, consistent with how LDAP mapping is configured today, would be enough even without UI support.

Reference: https://www.ibm.com/docs/en/api-connect/software/10.0.8_lts?topic=aua-configuring-ldap-group-mappings-api-manager-user-roles  see the note stating LDAP group mapping cannot be applied to Developer Portal users.