Fix airflow roles import crash on a role without permissions

[Eason09053360]

airflow roles export writes a role that holds no permissions as an entry with an
empty resource and action, so airflow roles import cannot always read back
what roles export produced.

Importing such a file behaved differently depending on where that entry sat:

• first entry — the command aborted with UnboundLocalError: cannot access local variable 'role_args', after the role had already been committed, leaving
  a half-finished import;
• any later entry — it silently re-applied the preceding entry's
  permissions, because role_args was still bound from an earlier iteration.

Either way the export/import round trip that these two commands exist to serve
was broken.

roles_import now adds the role unconditionally (add_role returns the existing
role, so a role spanning several resources — which roles_export emits as several
same-named entries — is safe) and skips the permission step when the entry carries
no resource or action, so the Namespace is built only where it is used.

Two surrounding branches went away with it: the outer
role_dict["name"] not in appbuilder.sm.get_all_roles() compares a str against
a list of Role ORM objects and is therefore always true, which made the mirrored
in block below it unreachable.

Why the existing test did not catch this

test_cli_import_roles already covers a permissionless role, but places it last
in the fixture, where the stale binding from an earlier iteration papers over the
missing one. The new test puts it first.

Testing

• uv run --project providers/fab pytest providers/fab/tests/unit/fab/auth_manager/cli_commands/test_role_command.py — 9 passed.
• Reverting only the source change (keeping the new test) fails exactly
  test_cli_import_roles_when_a_role_without_permissions_comes_first with the real
  UnboundLocalError, and nothing else.
• Reproduced on a live CLI before the fix:
  airflow roles import on [{"name": "X", "resource": "", "action": ""}]
  raised UnboundLocalError at role_command.py:219.

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines

[rjgoyln]

LGTM. Checked the mechanism rather than the symptom: FAB's Role defines no __eq__, so role_dict["name"] in appbuilder.sm.get_all_roles() compares a str against ORM objects and is always false — the outer branch always ran and the mirrored in block below it was dead — and both add_role implementations (upstream FAB and the provider's override.py) return the existing role, so calling it unconditionally is safe. Appending the new test to unpatched main does reproduce UnboundLocalError: cannot access local variable 'role_args', so it fails without the source change.

Two non-blocking notes below: one on the reordered key access in roles_import, one on an assertion in the new test.

Just my thoughts, feel free to resolve it.

---

Drafted-by: Claude Code (Opus 5); reviewed by @rjgoyln before posting