Upgrades an account's connection: the account switches to a new role the owner created from the
CloudFormation template, with a role setup Pennsieve issued to them for it (GET /role-policy?externalId=true).
Owner only. The new role is checked as at registration: the external ID was issued to the owner for that
role and is unexpired and unused, Pennsieve can use the role with it and not without it, and the role is in
the account's AWS account. Returns the old role's name, for the owner to delete.