[Subtask] Preserve User and Group membership integrity during concurrent Role deletion

### Describe the subtask

User/Group updates CAS the principal row but insert membership rows without fencing the referenced Role. A grant can resolve a Role, race with its deletion and cleanup, then insert an active membership to that deleted Role. Controlled reproductions confirm both principal types on H2, MySQL, and PostgreSQL. Joined reads filter deleted Roles; this finding does not establish an authorization bypass.

Validate and fence newly referenced stable Role IDs in the membership transaction, with a lock order compatible with principal writes and metalake cascades. Review update, insert, and overwrite membership writers without changing overwrite into a CAS API.

Acceptance:
- Cover both winner orders, batch atomicity, same-name recreation, and missing/cross-metalake endpoints on all three SQL engines.
- Preserve grant/revoke idempotency and define concurrent deletion outcomes under the existing error contract.
- Do not leave an active membership referencing a deleted Role after both operations complete.

Cleanup of existing orphan rows is a separate companion task.

### Parent issue

https://github.com/apache/gravitino/issues/10238

Start by locating the update, insert, and overwrite membership writers and the related membership transactions. Reproduce the concurrent Role deletion cases on H2, MySQL, and PostgreSQL, then verify both winner orders, batch atomicity, same-name recreation, missing or cross-metalake endpoints, idempotency, and the stated post-operation integrity condition.

Written by the indexing model from the issue text.