Migrate FAB GET /roles to FastAPI

[chiuinggum]

Why

• Align FAB provider with Airflow 3’s FastAPI-first direction and reduce remaining Connexion/Flask surface. This PR is a small step for issue Replace connexion with fast-api for FAB provider. #56730 by migrating a single endpoint GET /auth/fab/v1/roles.
• Related PR: Migrate FAB POST /roles to FastAPI #57199

How

• New FastAPI endpoint: implement GET /auth/fab/v1/roles on the FAB router with 200 OK on success; authorization via Depends(requires_fab_custom_view("GET", RESOURCE_ROLE)).
• Query params: order_by (supports - prefix for DESC), limit (via dependency enforcing [api].maximum_page_limit / [api].fallback_page_limit), offset>=0; FastAPI DI handles validation and OpenAPI schema generation.
• Models: add RoleCollectionResponse.
• Sorting: build_ordering() to guard allowed fields.
• Service: SQLAlchemy 2.0 style select(Role).order_by(...).offset(...).limit(...); fetch counts via Session.scalars(select(func.count(...))).one(), list via Session.scalars(stmt).unique().all() to avoid duplication.
• Error mapping/OpenAPI: 400/401/403/500 documented (FastAPI auto-generates schemas from code); validation errors surface as 422 by default.

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[vincbeck]

LGTM