This is a minor regression likely due to the queryset change for Role updates. It probably filters out public tenant roles there, rather than relying on the validation check later.

This can be reproduced in test_delete_system_role by modifying the test system to create the system role in the public tenant. We should add another test which attempts to delete a public tenant system role. This would be more representative of how data is actually set up in RBAC.