Updates specific fields of a risk. Only the fields provided in the request body will be updated.
All other fields will remain unchanged.

Request property names use snake_case in JSON.

Allowed values for patchable fields:

• title: risk title
• code: business code (e.g. RSK-12)
• description: risk description
• status: Not Assessed, Assessment in progress, Assessed, Needs Remediation, Remediated, Closed (Remediation in progress is also accepted for backward compatibility but is deprecated — use Needs Remediation)
• owner_email: user email
• team: team name
• department: department name
• category: risk category name