fix(certificate): guard against nil GetCertificateContext response in Update

[spbsoluble]

Summary

Fixes a confirmed SIGSEGV nil-pointer-dereference crash in the keyfactor_certificate
resource's Update path. Reported against provider v2.8.1; the same unguarded code
path is present in v2.9.0 (released), v2.9.1-rc.0, and v2 — so this gates a clean
v2.9.1.

Crash

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x200 ...]
keyfactor.resourceCommandCertificate.Update(...)
    keyfactor/resource_keyfactor_certificate.go:1487

Triggered during an in-place update of an existing certificate (a certificate_format
change to PFX) when the context GET /Certificates/{id} fails or returns nil.

Root cause

In Update, hasAPIErrors logged a warning but did not return, after which the code
immediately dereferenced certGetResp.ContentBytes in parseLeafCert. When
GetCertificateContext returned (nil, err) — e.g. a transient/remote API error,
permission/key-recovery rejection, or an unretrievable cert — the nil deref crashed the
whole provider instead of surfacing the API error.

The Read path was hardened with certGetResp != nil guards in v2.9.0; the same
hardening was never applied to Update.

Fix

• On hasAPIErrors (GET errored), log and return — hasAPIErrors already appended the
  error diagnostic.
• Added a defensive certGetResp == nil guard that surfaces an explicit
  ERR_SUMMARY_CERTIFICATE_RESOURCE_READ diagnostic and returns (covers the (nil, nil)
  case).
• Audited every certGetResp. access through the end of Update: all remaining accesses
  after the early return were already nil-guarded (checkCertDiags is internally nil-safe;
  the IsPendingRevocation, RevocationEffDate, and key-recovery blocks all use
  certGetResp != nil &&). No second landmine.

Regression test

TestUnitKeyfactorCertificateResource_UpdateNilGetResponse (unit, no lab) stands up an
httptest TLS server returning HTTP 500 on GET /Certificates/..., sets a PFX Plan over a
PEM State, and calls Update inside a deferred recover so any panic fails the test.
Asserts a clean diagnostic instead of a crash.

• RED (without fix): FAIL — Update panicked (nil-deref regression): runtime error: invalid memory address or nil pointer dereference
• GREEN (with fix): PASS
• go build ./... clean; gofmt clean; full TestUnitKeyfactorCertificate* suite passes.

Notes

• PR base is fix/template-role-binding-pagination (stacks on top of fix: paginate template lookup for keyfactor_template_role_binding #173) per request.
• Review cycle in progress: code review + security review, then a compliance audit pass.