fix(certificate-authority): preserve Daily schedule variant on read/update

Command represents each of the CA's full_scan/incremental_scan/
threshold_check schedules as a tagged union that can be Interval-shaped
or Daily-shaped. The provider only understood Interval, so a
Daily-shaped schedule fell through to Null on Read -- indistinguishable
from "no schedule configured." Since the update endpoint is a
full-replace PUT, an omitted schedule field clears it server-side, so
any CA using a Daily schedule had it silently wiped on every apply.
Confirmed live against the lab's real CA (id 1, "Sub-CA"): an ordinary
import + apply previously cleared its live daily full_scan schedule.

Adds full_scan_daily_time / incremental_scan_daily_time /
threshold_check_daily_time (RFC3339, mutually exclusive with the
existing *_interval_minutes attribute per schedule), fixes
caResponseToState/buildCARequest via new scheduleToState/buildSchedule
helpers, extends preserveCAUpdateFields so an undeclared update
preserves whichever variant prior state holds without resurrecting the
other, adds ValidateConfig to reject conflicting/malformed schedule
attributes, and updates Delete()'s schedule-clearing path to null out
the new attributes too.

Regenerated docs/resources/certificate_authority.md for the new
attributes.

Author: spbsoluble

docs/resources/certificate_authority.md

@@ -75,8 +75,10 @@ resource "keyfactor_certificate_authority" "ejbca" {
 - `failure_max` (Number) An integer that sets the maximum number of certificate requests that can fail before an alert is triggered.
 - `force_save` (Boolean) A Boolean indicating whether to save the CA record even if the CA connectivity test fails. Useful when provisioning a CA record before the CA server is reachable. Write-only — not returned by the server; preserved from config/state after reads.
 - `forest_root` (String) A string indicating the forest root name or DNS domain name (retained for legacy purposes).
-- `full_scan_interval_minutes` (Number) Interval in minutes for the full synchronization schedule of this certificate authority. Must be one of: 1,2,3,4,5,6,10,12,15,20,30,60,120,180,240,360,480,720. Warning: creates a Windows Task Scheduler entry for DCOM CAs that blocks CA deletion.
-- `incremental_scan_interval_minutes` (Number) Interval in minutes for the incremental synchronization schedule of this certificate authority. Must be one of: 1,2,3,4,5,6,10,12,15,20,30,60,120,180,240,360,480,720. Warning: creates a Windows Task Scheduler entry for DCOM CAs that blocks CA deletion.
+- `full_scan_daily_time` (String) RFC3339 timestamp (e.g. "2026-07-17T15:46:00Z") whose time-of-day component sets a once-daily full synchronization schedule for this certificate authority. Mutually exclusive with full_scan_interval_minutes.
+- `full_scan_interval_minutes` (Number) Interval in minutes for the full synchronization schedule of this certificate authority. Must be one of: 1,2,3,4,5,6,10,12,15,20,30,60,120,180,240,360,480,720. Mutually exclusive with full_scan_daily_time. Warning: creates a Windows Task Scheduler entry for DCOM CAs that blocks CA deletion.
+- `incremental_scan_daily_time` (String) RFC3339 timestamp (e.g. "2026-07-17T15:46:00Z") whose time-of-day component sets a once-daily incremental synchronization schedule for this certificate authority. Mutually exclusive with incremental_scan_interval_minutes.
+- `incremental_scan_interval_minutes` (Number) Interval in minutes for the incremental synchronization schedule of this certificate authority. Must be one of: 1,2,3,4,5,6,10,12,15,20,30,60,120,180,240,360,480,720. Mutually exclusive with incremental_scan_daily_time. Warning: creates a Windows Task Scheduler entry for DCOM CAs that blocks CA deletion.
 - `issuance_max` (Number) An integer that sets the maximum number of certificates that can be issued before an alert is triggered.
 - `issuance_min` (Number) An integer that sets the minimum number of certificates that should be issued before an alert is triggered.
 - `key_retention` (String) Key retention policy for the CA. Accepts the named form (Disabled, Indefinite, AfterExpiration, FromIssuance) or the equivalent integer string ("0"–"3"). Always stored in state as the named form.
@@ -89,7 +91,8 @@ resource "keyfactor_certificate_authority" "ejbca" {
 - `scope` (String) For HTTPS CAs, a string indicating scopes included in token requests, separated by spaces.
 - `standalone` (Boolean) A Boolean that sets whether the certificate authority is a standalone CA.
 - `subscriber_terms` (Boolean) A Boolean that sets whether to add a checkbox forcing users to agree to terms.
-- `threshold_check_interval_minutes` (Number) Interval in minutes for the threshold monitoring check schedule on this CA. Must be one of: 1,2,3,4,5,6,10,12,15,20,30,60,120,180,240,360,480,720.
+- `threshold_check_daily_time` (String) RFC3339 timestamp (e.g. "2026-07-17T15:46:00Z") whose time-of-day component sets a once-daily threshold monitoring check schedule on this CA. Mutually exclusive with threshold_check_interval_minutes.
+- `threshold_check_interval_minutes` (Number) Interval in minutes for the threshold monitoring check schedule on this CA. Must be one of: 1,2,3,4,5,6,10,12,15,20,30,60,120,180,240,360,480,720. Mutually exclusive with threshold_check_daily_time.
 - `time_after_expiration` (Number) Time value after expiration before cleanup occurs. Used with time_after_expiration_units.
 - `time_after_expiration_units` (Number) Units for time_after_expiration: 0=Days, 1=Weeks, 2=Months.
 - `token_url` (String) For HTTPS CAs, a string indicating the bearer token URL of the identity provider.