okta_push_group: remove from state on 404 instead of erroring during read

[akemner-figma]

Problem

When an okta_push_group mapping (or its source group) is deleted outside Terraform, the next plan/refresh fails hard:

Error: Error reading Okta push group mapping … 404 Not Found

Because the resource is never dropped from state, the plan cannot proceed, and the only recovery is a manual terraform state rm. This is especially painful on locked-down/high-integrity backends where ad-hoc state surgery is restricted. Delete has the same gap — it errors if the mapping is already gone.

Root cause

pushGroupResource.Read discards the HTTP response and treats every error from GetGroupPushMapping as fatal — there is no not-found branch, so a deleted mapping surfaces as a plan error instead of being reconciled as drift. Delete likewise treats a 404 as a failure rather than an already-deleted no-op.

Fix

• Read: on http.StatusNotFound, call resp.State.RemoveResource(ctx) and return.
• Delete: treat a 404 from either the deactivate or delete call as already-deleted (return without error) — making delete idempotent.

Non-404 errors are unchanged.

Precedent

This is the behavior the plugin framework documents for Read:

Ignore returning errors that signify the resource is no longer existent, call the response state RemoveResource() method, and return early.

— plugin-framework Read recommendations

Resources in this provider already follow it — e.g. okta_identity_source_group and okta_group_owners call resp.State.RemoveResource(ctx) on a 404 in Read and tolerate a 404 in Delete. It's also the standard convention across the ecosystem: the SDKv2 googleworkspace_group resource, for instance, drops itself from state on a 404 (d.SetId("")). This change brings okta_push_group in line.

Test

Adds TestAccResourceOktaPushGroup_disappears, which deletes the mapping out-of-band via the API and asserts the refresh removes it from state and yields a non-empty plan. Without the fix this step errors on the 404.

Notes

• No schema, config, or default-value changes; the behavior change is limited to the deleted-outside-Terraform case.
• No documentation changes required.
• CHANGELOG intentionally not modified, per the contributing guide (the provider team updates it at merge time).