Update auto-join and/or IdP-initiated settings on an existing tenant SSO config. Setting allowIDPInitiated from false to true rotates the static nonce; setting it to false clears the nonce and re-syncs the matching Auth0 connection.

autoJoinRoleIDs is a replacement set: omission retains it and [] clears it. Each role must be available to the tenant and visible to the caller. An empty set grants no roles through auto-join. Saving this configuration does not bulk-provision or retroactively rewrite existing users; it configures subsequent SSO auto-join behavior.