docs(changelog): document owner_role_name declarative clear fix

Adds a v2.9.1 entry for owner_role_name = "" now sending Command's
verified owner-clear payload (omit both NewRoleId/NewRoleName) instead
of a literal empty-string role name; omitting the field still leaves
ownership unmanaged.

Author: spbsoluble

CHANGELOG.md

@@ -37,6 +37,7 @@ A provider-wide audit for the same bug class as #175 — an omitted attribute an
 - fix: `keyfactor_template_role_binding` role attach/detach no longer fails with `'Policies' cannot be empty` on templates linked to an enrollment pattern — Command's update endpoint is full-replace and was clearing the template's key-algorithm policy whenever it wasn't resent. Fixes [#180](https://github.com/keyfactor-pub/terraform-provider-keyfactor/issues/180)
 - fix: `keyfactor_template_role_binding` role attach/detach no longer silently resets a template's `KeyUsage` bitmask to `0` on Command — `buildTemplateRoleBindingUpdateArg` never carried the template's existing `KeyUsage` onto the full-replace `UpdateTemplate` request, even though this resource does not manage `KeyUsage` at all. Requires `keyfactor-go-client/v3` `v3.6.0-rc.0`, which corrects `UpdateTemplateArg.KeyUsage` from `*bool` to `*int` to match Command v25.5's wire format (an int bitmask on both `GET` and `PUT`; a JSON boolean is rejected with `400`)
 - fix: `keyfactor_certificate` `owner_role_name` no longer causes a spurious ownership change (and drift) when left unset in config
+- fix: `keyfactor_certificate` `owner_role_name = ""` now declaratively clears certificate ownership — previously an explicit empty string took the same code path as a real role name and sent `{"NewRoleName":""}` to `PUT /Certificates/{id}/Owner`, which Command does not treat as a clear. Per verified Command v25.5 behavior, removing an owner requires omitting both `NewRoleId` and `NewRoleName` from the request entirely; the clear sentinel is preserved on Read so config-vs-state stays settled instead of drifting `"" -> null -> ""`. Omitting `owner_role_name` from config continues to mean the owner is unmanaged/preserved
 - fix: OAuth security claims missing a provider sub-object in Command's response now surface a warning instead of silently clearing the claim's provider association on the next update
 
 ### Certificate Authorities — schedule variants
@@ -56,7 +57,7 @@ Command represents each CA's `full_scan`/`incremental_scan`/`threshold_check` sc
 - refactor: added `keyfactor/attribute_contract.go`, generalizing the ad hoc "server-managed unless declared in config" pattern already used by `template_role_binding`'s `KeyUsage`, `security_role`'s `Permissions`, and `security_identity`'s `Roles` into two shared primitives — `declaredInConfig` (always keyed on the update request's `Config`, never `Plan`, since Optional+Computed plan modifiers rewrite `Plan` to carry forward state on omission) and a `pairedVariantModifier` for mutually-exclusive attribute pairs (e.g. an interval-based vs. a daily-time-based schedule variant); no behavior change on its own.
 - test(template): re-recorded the five `GET /Templates` VCR cassettes for the paginated request (`?PageReturned&ReturnLimit`); added an opt-in `newVCRProviderFactoriesReplayable` variant used only by the read-only certificate-template data-source unit test.
 - test(integration): two lab-constraint-only failures (`TestIntKeyfactorCertificateResource_SANs`, `TestIntKeyfactorCertificateAuthorityResourceUpdate`) are now handled in-test (skip with warning) so unexpected failures still fail.
-- docs: regenerated `docs/resources/identity.md` (`roles` description) and `docs/resources/certificate_authority.md` (new schedule attributes) via `make tfdocs`.
+- docs: regenerated `docs/resources/identity.md` (`roles` description), `docs/resources/certificate_authority.md` (new schedule attributes), and `docs/resources/certificate.md` (`owner_role_name` omit/clear contract) via `make tfdocs`.
 - chore(release): add `# v2.9.1` CHANGELOG section; version set to `2.9.1-rc.1`.
 - chore(make): add `api-update-template`/`api-template-schema-diff` and `api-set-cert-owner`/`api-clear-cert-owner` verification-gate targets, mirroring the existing `api-update-ca`/`api-ca-schema-diff` pattern, used to live-verify Command v25.5 API wire behavior ahead of the CA schedule/owner work below.
 - refactor: deduped four near-identical `*enumType -> types.Int64` pointer converters (`enrollmentTypePtrToTfInt64`, `keyRetentionPtrToTfInt64`, `cleanupTimeUnitsPtrToTfInt64`, `pamParameterDataTypePtrToTfInt64`) into one generic `enumPtrToTfInt64` helper; no behavior change.