How Do I Grant Permissions to Replace a Function?
Apparently, whatever you are doing tries to CREATE OR REPLACE the function SYSTOOLS.JSON_VAL2. To replace any object the ID performing the operation must be the owner of that object, that is, the same ID that issued the very first CREATE statement. 

You have several options:


Use the TRANSFER OWNERSHIP statement to change the function owner. SECADM can do that.
Determine the current owner (SELECT OWNER FROM SYSCAT.ROUTINES WHERE ROUTINENAME = 'JSON_VAL2' AND ROUTINESCHEMA = 'SYSTOOLS') and perform your task while logged in as that user.
Drop the object explicitly, for which DBADM is sufficient, before performing your task.