Building an updated package from a bzr branch tends to differ a fair amount depending on who maintains the branches or how the package works in general. However, here are a few guidelines for a quick and dirty update of just about any package, to be pushed to a PPA:
Get the branch:
bzr branch lp:~network-manager/network-manager/openconnect-ubuntu.head
Then switch to it, and update changelog:
dch -i
dch -i will simply open a new entry in debian/changelog, increasing the version revision by one. If you want to add a patch, that's perfect, but if you want to update to a newer version of the upstream software, you'll need to update the version number before the dash (-). Say, a version in 1.2-0ubuntu1, if you start dch -i it will change to 1.2-0ubuntu2, which is good for patching but if you need a new version you'd likely want to change that to 1.3-0ubuntu1.
If you need to patch, now is the time to add your changes. In branches that have only a debian/ directory, you can use bzr bd-do (requires the bzr-builddeb package) to switch to a work tree where you can do changes, use quilt or any patch system, then "exit 0" to have your changes copied back.
If you want a new upstream version, once changelog has been changed you'd likely run a command similar to this one:
debian/rules get-orig-source
This will usually download the right tarball from the upstream publisher to get you started. If further changes are necessary, proceed as above for "patching" or changing other files in the debian/ directory, otherwise you're almost done:
bzr bd -S
bzr bd will take care of building. Calling it with no arguments starts to build on your system, while calling it with -S tells it to prepare a source package, which will include a ..._source.changes file which is what you want to upload to your PPA (use dput ppa:<yourname>/<name of your ppa> <changes file> to do that).
For NetworkManager packages, it's a little different. Let's look at openconnect specifically:
bzr branch lp:~network-manager/network-manager/openconnect-ubuntu.head network-manager-openconnect
Make sure you also have all the build dependencies:
sudo get-build-deps
With the branch retrieved, this will read the debian/control file and try to download everything you need to build network-manager-openconnect. You might need git too though. Once that is done, run get-orig-source to get just the tarball of the very latest snapshot from git:
debian/rules get-orig-source
You'll see text fly by and a tarball with a long version number appear. That's the latest code you could get for nm-openconnect.
You will then need to update changelog with the version number from the tarball, just keeping the -0ubuntu1 suffix intact.
Or, change debian/changelog with the specific version number you want, then run:
debian/rules get-current-source
Since the plugins don't change much, you should be able to just build the package from there, using bzr bd as above. If not, apply any changes necessary as above.
Don't forget to bzr commit after you've made changes.
I first forgot to add, don't hesitate to use the merge proposal system (Propose for merging link your branch's page on LP) when the changes you're making could benefit others. Usually you can just propose for merging against the branch yours is based on (e.g. lp:~network-manager/network-manager/openconnect-ubuntu.head in this case).