These endpoints need either to be removed, or they need to incorporate dual-write logic to the Relations API in Kessel.

Since they were deprecated long ago, we prefer to remove them and save ourselves the trouble.

If they are left and still usable, their use can lead to permanently inconsistent data between Relations and RBAC. For example, if someone (e.g. a bad actor or by mistake) removed a role from a group in RBAC, it would still have access but it would not appear as if it did.