fix: stop team update from deleting externally-managed scoped user roles

[fv-nhastings]

What

Stops the octopusdeploy_team resource from deleting scoped user roles that are managed outside the team resource (i.e. via standalone octopusdeploy_scoped_user_role resources) whenever the team is created or updated.

Fixes #180. Follow-up to #100 / #105.

Why

updateUserRoles (called on every team Create/Update) reconciled the team's scoped user roles by:

1. building newUserRoles from the team's own inline user_role blocks,
2. fetching all scoped user roles attached to the team on the server, and
3. deleting every server role not present in newUserRoles.

When a team is managed without inline user_role blocks (roles managed by standalone octopusdeploy_scoped_user_role resources), newUserRoles is empty, so step 3 deletes every scoped user role attached to the team. Terraform then detects the standalone resources as missing on the next refresh and recreates them — requiring 2+ applies to converge, or looping indefinitely if the team drifts on every apply.

PR #105 addressed the symptom on the read/refresh path (filterUserRolesByPreviousState in mapTeamResourceToState), but the write path in resource_team.go::updateUserRoles was never given the equivalent ownership check, so the deletion persisted (re-reported in #180).

How

Apply the same ownership filter to removals. Removal candidates are now drawn only from roles this team resource previously managed (derived from prior state via the existing filterUserRolesByPreviousState helper), rather than from every role on the server:

• Update now reads req.State and passes the prior user_role set into updateUserRoles.
• Create passes a null set (nothing was previously managed, so nothing is removable — and a freshly created team has no pre-existing roles anyway).
• findRemovedScopedUserRoles is now fed the filtered "previously managed" set instead of all server roles.

Add/edit behavior is unchanged; only the removal set is narrowed. Roles managed by inline user_role blocks continue to be added/removed/edited exactly as before.

Tests

Unit — TestUpdateUserRolesRemovalOwnership covering the removal-candidate selection:

• team with no inline user_role blocks → externally-managed roles are not selected for removal (the octopusdeploy_scoped_user_roles always getting removed when octopusdeploy_team is modified #180 case);
• inline-user_role team that drops one role from config → only that previously-owned role is removed, while an externally-managed role on the same team is left untouched.

Acceptance — TestAccOctopusDeployTeamUpdateKeepsStandaloneScopedUserRole: creates a team with a standalone octopusdeploy_scoped_user_role, changes the team's description to force a team update, and asserts an empty follow-up plan (the role survives). The pre-existing TestAccOctopusDeployTeamScopedUserRoleNoConflict never updated the team after adding the standalone role, so it did not exercise this path.

Validated red→green against a live Octopus instance: the new acceptance test fails on the unpatched code (post-update refresh plan shows octopusdeploy_scoped_user_role ... will be created, Plan: 1 to add) and passes with the fix. Existing TestFilterUserRolesByPreviousState continues to pass. gofmt clean; go vet clean.

[CLAassistant]

All committers have signed the CLA.