fix(resources): handle empty/null/unknown IDs in Read methods

[aditmeno]

Summary

This PR addresses issues where Terraform/OpenTofu runs refresh before create for new resources, causing API errors when trying to read non-existent resources.

Problem

When using tofu apply (or terraform apply) with the -refresh=true flag (which is the default), Terraform attempts to refresh the state of all resources before making changes. For resources that don't yet exist (i.e., resources being created for the first time), the Read method is called with an empty/null/unknown ID. Without proper handling, this causes the provider to make API calls with empty identifiers, resulting in errors.

Solution

• Add early return checks in Read methods for 31 resources to gracefully handle null/unknown/empty resource identifiers by calling resp.State.RemoveResource(). This signals to Terraform that the resource needs to be created.

• Fix calls_sfu_app: Consolidate app_id and uid fields (they were duplicates) by mapping the API's uid response to app_id with proper Computed+Optional schema and UseStateForUnknown plan modifier.

• Fix zero_trust_access_service_token: Replace AlsoRequires validator with a custom ConfigValidator that only requires previous_client_secret_expires_at when client_secret_version > 1 (during rotation). The previous validator was problematic because client_secret_version has a default value of 1, so it's always set, incorrectly triggering the validator on initial creation.

Affected Resources

• account, api_shield_operation, api_shield_schema, calls_sfu_app, calls_turn_app
• connectivity_directory_service, d1_database, list_item, notification_policy
• queue, queue_consumer, schema_validation_schemas, stream, stream_live_input
• stream_watermark, turnstile_widget, web_analytics_site, worker
• zero_trust_access_application, zero_trust_access_custom_page
• zero_trust_access_service_token, zero_trust_device_custom_profile
• zero_trust_device_managed_networks, zero_trust_dex_test, zero_trust_dlp_dataset
• zero_trust_dns_location, zero_trust_tunnel_cloudflared, zone

Test Plan

• Verify tofu plan / terraform plan works for new resources without errors
• Verify tofu apply / terraform apply successfully creates resources
• Verify existing resources continue to work (refresh/update/delete)
• Test calls_sfu_app resource creation and verify app_id is properly populated
• Test zero_trust_access_service_token initial creation without previous_client_secret_expires_at
• Test zero_trust_access_service_token rotation with client_secret_version > 1 requires previous_client_secret_expires_at