List roles visible to the caller in the specified tenant. A role's optional visibilityPermission controls whether that role is discoverable; it does not scope the data accessible through the role. The endpoint does not populate the optional nested permissions array.