fix(certificate-authority): Optional+Computed audit — properties diff suppression, config-constraint validation, null-safe auth-cert metadata

[spbsoluble]

Stacked on #184 (merge that first; this diff is only the last four commits). Findings come from an attribute-by-attribute Optional/Computed audit of keyfactor_certificate_authority, the follow-up to the schedule-contract work in #182.

Fixes

• properties no longer shows a permanent diff when Command reformats stored JSON. Command's GET re-serializes the stored properties blob (key order/whitespace), so a declared value could diff on every plan even though nothing changed. A new plan modifier keeps the prior state value when plan and state are semantically equal JSON; genuine value changes still surface.
• Documented config constraints are now actually validated at plan time instead of failing server-side (or silently misbehaving) at apply:
  • enforce_unique_dn and new_end_entity_on_renew_and_reissue cannot both be true
  • new_end_entity_on_renew_and_reissue = false is rejected for HTTPS CAs (ca_type = 1)
  • allowed_enrollment_types, use_allowed_requesters, and allowed_requesters are rejected when standalone = false
    Null/unknown values never error — only explicitly configured violations are rejected.
• Auth-certificate metadata reads as null when the CA has no auth certificate. auth_certificate_issued_dn / auth_certificate_issuer_dn / auth_certificate_thumbprint previously landed in state as known empty strings.
• Docs: write-only secrets clear on omission. explicit_password, auth_certificate, auth_certificate_password, and client_secret are not preserved when removed from config — the full-replace update omits them and Command clears the stored credential. The attribute descriptions now say so explicitly, since this intentionally differs from the omit=unmanaged contract the rest of the resource follows.

Verification

• New unit tests per finding, including a red-baseline test that runs the pre-fix UseStateForUnknown modifier against the reordered-JSON scenario and asserts it does not suppress the diff (proving the new modifier is load-bearing).
• Red→green confirmed empirically for the behavior changes: with the modifier/validators neutered, the corresponding tests fail; restored, they pass.
• Full unit suite: 200 pass, 3 known skips, 0 fail.

Audited but intentionally untouched

• Every other Computed attribute already has a correct plan modifier and every pointer field in the Read path already routes through nil-safe helpers — the fix: resolve 29 inconsistent-state findings from resource-wide audit #177–fix(certificate-authority): preserve Daily schedule variant on read/update #182 hardening covered them; the CHANGELOG's "unaudited zero-value coercion" caveat for this resource is updated accordingly.
• The certificate resource's standalone-CA enrollment path (certificate_authority set with neither certificate_template nor certificate_enrollment_pattern) is rejected by the at-least-one-of validator despite the schema description promising it works. That is a behavior-changing fix on a different resource and needs its own design discussion/PR — deliberately not bundled here.