Fix terraform import fidelity: stop reverting, dropping, and rotating real state

[Rupam-It]

Summary

Three separate bugs meant terraform import did not produce full-fidelity
state, violating the basic contract that import + plan should show no
changes and shouldn't mutate real infrastructure:

• Systemic Default-clobbering (node_policy, node_policy_target,
  workload_policy, workload_policy_target — ~81 attributes): the framework
  re-applies an Optional+Computed attribute's Default on every plan
  whenever config omits it, even when state already holds a real value.
  Invisible for resources this provider creates itself, but it silently
  reverted any imported (or externally set) value back to its default on
  the very next apply. Added preserve*StateOverDefault plan modifiers and
  applied them wherever Default is used.

• Cluster token rotated on every apply after import (devzero_cluster):
  token is write-once — only CreateCluster ever returns it, GetCluster
  never does. A ModifyPlan hook treated a null token in state as
  something to auto-fix, forcing Update (and a real ResetClusterToken
  call) on every single apply of an imported cluster — rotating a live
  cluster's auth token as a side effect of having imported it. Removed the
  hook; a null token is now just carried forward as-is.

• Real nested-rule data dropped on read after import
  (devzero_workload_rule): a custom preserveNullsFrom helper nulled out
  cpu_rule/memory_rule/gpu_rule/hpa_rule/emergency_response/
  containers (and 4 scalar fields) in Read whenever prior state had
  them null — always true immediately after import — wiping real backend
  data on the first refresh. Removed it in favor of plain Optional+Computed,
  paired with UseStateForUnknown modifiers to avoid a follow-on decode
  crash when both config and prior state are null for these nested fields.

Also adds a CLI-level acceptance harness (ProtoV6ProviderFactories wired
to the existing in-memory fake backend) and import → clean-plan → edit →
reapply round-trip tests per affected resource, plus a regression test for
an already-fixed node_policy bug (azure.image_version-only blocks
getting dropped as "empty" on read).

Test plan

• go build ./...
• go test ./...
• TF_ACC=1 go test ./... — includes new import round-trip tests for
  node_policy, devzero_cluster, and devzero_workload_rule
  (import → clean plan → edit an attribute → reapply → verify against
  backend)
• Manual terraform import against a real DevZero backend (not run
  this session — recommended before merge)