Realm-admin escalation via protected-role renaming

Privilege escalation in Red Hat build of Keycloak allows remote authenticated users with manage-clients to gain realm-admin access. The admin role rename endpoint accepts protected role names while assignment guards identify protected roles by name, and composites persist by entity ID. An administrator with manage-clients can rename a protected role, add it as a composite child, and restore its name, granting realm-wide privileges that survive permission revocation and reboots.