Manage people team access for restricted people managers

A new PATCH /users/USERID endpoint updates which teams a restricted people manager can manage via a peopleTeams array — an empty array revokes every grant, and omitting the field leaves grants untouched. peopleTeams is now also returned by GET /users and GET /users/USERID. The field is limited to 1000 unique team ids, requires the target user's managePeople permission to be restricted (otherwise 400), and returns 403 on accounts without the people team permissions feature.