fix(api): detect role inheritance cycles through any parent edge

traverse every role->parent edge with a bfs cycle check instead of only the
first one, so updates that would create an inheritance cycle through any
parent are rejected with 422.