Truncate access review roles with badge list

Long role strings in the access review table broke row layout when
drivers joined many roles into one comma-separated value. Expose
roles as a string array in GraphQL by splitting the stored role at
the API layer, and render the first three roles as badges with a
"+X more" popover for the rest.

Closes ENG-459.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/mcp/v1/specification.yaml

@@ -7684,7 +7684,7 @@ components:
         - access_review_campaign_source_id
         - email
         - full_name
-        - role
+        - roles
         - job_title
         - is_admin
         - mfa_status
@@ -7712,9 +7712,11 @@ components:
         full_name:
           type: string
           description: User full name
-        role:
-          type: string
-          description: User role in the system
+        roles:
+          type: array
+          items:
+            type: string
+          description: User roles in the system
         job_title:
           type: string
           description: User job title