Expand unit test coverage for the cache layer and realization polling (#2316)

* Expand unit test coverage for low-coverage resources and data sources

Raises overall unit test coverage on ./nsxt/... from 68.8% to 73.8%,
building on the prior "near-zero-coverage data sources" pass:

- 8 resources whose existing mock tests only exercised error/guard
  paths now cover Create/Read/Update/Delete success paths too:
  cluster_security_config (20% -> ~97%), ldap_identity_source
  (20% -> ~97%), l7_access_profile (24% -> ~89%), idps_cluster_config
  (25% -> ~97%), segment_port_profile_bindings (33% -> ~86%),
  host_transport_node (36% -> ~88%), ip_pool_block_subnet
  (37% -> ~90%), ipsec_vpn_session (41% -> ~74%). Adds minimal
  package-level client-constructor seams (mirroring the existing
  cli*Client convention used throughout the provider) to
  cluster_security_config and idps_cluster_config so their SDK
  clients can be mocked; reuses existing seams elsewhere.

- 9 near-identical LB monitor/application profile resources gain
  success-path tests via their already-shared mock helpers,
  raising each from ~46-50% to 84-100%.

- 13 data sources that previously had no mock test at all now have
  one, nearly all reaching 100%: 8 trivial generic-search wrappers,
  plus provider_info, host_upgrade_group, edge_cluster,
  gateway_interface, and proxy_config (the last reusing an existing
  seam from its sibling resource file instead of constructing its
  SDK client inline).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Expand unit test coverage for the cache layer and realization polling

cache_test.go's tests predated the unittest tag convention and were named
outside the TestMock*Nsxt*/TestUnitNsxt_* pattern that `make test-unit` (and
CI) filters on via -run, so they never actually executed as part of the
tracked unit test suite. Tag the file `//go:build unittest` and rename its
tests to TestUnitNsxt_* so they're finally counted.

Add nsxt/cache_unit_test.go covering the cache.go helpers that were still at
0%: query-string/query-key construction, the per-type/per-query cache
buckets (hit, miss-and-populate, and post-write-bypass paths) including the
composite gateway-policy/security-policy + rule merge, tag stripping and
provider-managed-tag patching, and TryCacheRead/CacheAwareResourceRead/
cacheAwareDataSourceReadByID end to end using the existing cliQueryClient
stub pattern from policy_search_unit_test.go.

Also add coverage for nsxtPolicyWaitForRealizationStateConf (policy_utils.go),
reusing the existing realization-info mock helper to exercise its Refresh
closure (found, not-yet-realized, and error cases).

Package coverage under `go test ./nsxt -tags=unittest -run='^(TestMock.*Nsxt.*|TestUnitNsxt_.*)' -coverpkg=./nsxt`
moves from 74.0% to 74.8%, with cache.go itself going from mostly-0% to
75-100% coverage across nearly every function.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Kobi Samoray <kobis@Kobis-MacBook-Air.local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

nsxt/cache_test.go

@@ -1,3 +1,9 @@
+//go:build unittest
+
+// © Broadcom. All Rights Reserved.
+// The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
+// SPDX-License-Identifier: MPL-2.0
+
 package nsxt
 
 import (
@@ -11,7 +17,7 @@ import (
 	"github.com/vmware/vsphere-automation-sdk-go/services/nsxt/model"
 )
 
-func TestProviderManagedTagsSearchQuery(t *testing.T) {
+func TestUnitNsxt_providerManagedTagsSearchQuery(t *testing.T) {
 	if got := providerManagedTagsSearchQuery(""); got != "" {
 		t.Fatalf("empty runID: want empty, got %q", got)
 	}
@@ -27,7 +33,7 @@ func TestProviderManagedTagsSearchQuery(t *testing.T) {
 	}
 }
 
-func TestBuildTagQuery(t *testing.T) {
+func TestUnitNsxt_buildTagQuery(t *testing.T) {
 	tagSchema := map[string]*schema.Schema{
 		"tag": {
 			Type:     schema.TypeSet,
@@ -101,7 +107,7 @@ func TestBuildTagQuery(t *testing.T) {
 	})
 }
 
-func TestAttachRulesByParentPathSecurityPolicy(t *testing.T) {
+func TestUnitNsxt_attachRulesByParentPathSecurityPolicy(t *testing.T) {
 	policyPathA := "/infra/domains/default/security-policies/pol-a"
 	policyPathB := "/infra/domains/default/security-policies/pol-b"
 
@@ -139,7 +145,7 @@ func TestAttachRulesByParentPathSecurityPolicy(t *testing.T) {
 	})
 }
 
-func TestEnsureProviderManagedTagsWithPatchFunc(t *testing.T) {
+func TestUnitNsxt_ensureProviderManagedTagsWithPatchFunc(t *testing.T) {
 	type testTagObj struct {
 		Tags []model.Tag
 	}
@@ -218,7 +224,7 @@ func int64Ptr(v int64) *int64 {
 	return &v
 }
 
-func TestGroupRulesByValidParentPath(t *testing.T) {
+func TestUnitNsxt_groupRulesByValidParentPath(t *testing.T) {
 	pathA := "/policies/a"
 	pathB := "/policies/b"
 	valid := map[string]struct{}{pathA: {}, pathB: {}}
@@ -286,7 +292,7 @@ func attachRulesToSecurityPoliciesForTest(parents []model.SecurityPolicy, rules
 	)
 }
 
-func TestAttachRulesByParentPathGatewayPolicy(t *testing.T) {
+func TestUnitNsxt_attachRulesByParentPathGatewayPolicy(t *testing.T) {
 	policyPathA := "/orgs/p/proj/vpcs/vpc/gateway-policies/pol-a"
 	policyPathB := "/orgs/p/proj/vpcs/vpc/gateway-policies/pol-b"
 
@@ -391,7 +397,7 @@ func TestAttachRulesByParentPathGatewayPolicy(t *testing.T) {
 	})
 }
 
-func TestGetQueryStringVPCScopedToProjectNotVPC(t *testing.T) {
+func TestUnitNsxt_getQueryStringVPCScopedToProjectNotVPC(t *testing.T) {
 	// VPCID must be omitted from the cache bucket key: NSX policy paths/IDs are unique
 	// within a project across all VPCs, and narrowing the key (and the underlying search)
 	// to a single VPC caused a fresh cache bucket per VPC, regressing cache mode below
@@ -414,7 +420,7 @@ func TestGetQueryStringVPCScopedToProjectNotVPC(t *testing.T) {
 	}
 }
 
-func TestProjectScopedSearchContextStripsVPCID(t *testing.T) {
+func TestUnitNsxt_projectScopedSearchContextStripsVPCID(t *testing.T) {
 	for _, clientType := range []utl.ClientType{utl.VPC, utl.Multitenancy} {
 		in := utl.SessionContext{ClientType: clientType, ProjectID: "proj-1", VPCID: "vpc-1"}
 		out := projectScopedSearchContext(in)
@@ -433,7 +439,7 @@ func TestProjectScopedSearchContextStripsVPCID(t *testing.T) {
 	}
 }
 
-func TestShouldIndexByPathForVPCScopedTypes(t *testing.T) {
+func TestUnitNsxt_shouldIndexByPathForVPCScopedTypes(t *testing.T) {
 	// VPC-scoped types must key by path, not short id: NSX ids for these types (often
 	// user-chosen via nsx_id) are only guaranteed unique within their own VPC, but the cache
 	// populate search/bucket for these types is now shared across all VPCs in a project.
@@ -456,7 +462,7 @@ func TestShouldIndexByPathForVPCScopedTypes(t *testing.T) {
 	}
 }
 
-func TestConverListToMapByTypeVpcScopedResourcesIndexedByPath(t *testing.T) {
+func TestUnitNsxt_converListToMapByTypeVpcScopedResourcesIndexedByPath(t *testing.T) {
 	// Two different VPCs in the same project can legitimately have a VpcSubnet with the same
 	// user-chosen short id (getOrGenerateID2 only checks uniqueness within the current VPC).
 	// Since the cache bucket for VPC-scoped types is now shared project-wide, both objects
@@ -484,7 +490,7 @@ func TestConverListToMapByTypeVpcScopedResourcesIndexedByPath(t *testing.T) {
 	}
 }
 
-func TestErrCacheUseBackendDirect(t *testing.T) {
+func TestUnitNsxt_errCacheUseBackendDirect(t *testing.T) {
 	if !errors.Is(errCacheUseBackendDirect, errCacheUseBackendDirect) {
 		t.Fatal("errors.Is should match sentinel to itself")
 	}
@@ -494,7 +500,7 @@ func TestErrCacheUseBackendDirect(t *testing.T) {
 	}
 }
 
-func TestReflectStringField(t *testing.T) {
+func TestUnitNsxt_reflectStringField(t *testing.T) {
 	t.Run("returns-pointer-value", func(t *testing.T) {
 		obj := &model.Group{DisplayName: strPtr("g1")}
 		got := reflectStringField(obj, "DisplayName")
@@ -532,7 +538,7 @@ func TestReflectStringField(t *testing.T) {
 	})
 }
 
-func TestCacheAwareDataSourceReadByIDBypassesCacheForShortIDOnPathIndexedTypes(t *testing.T) {
+func TestUnitNsxt_cacheAwareDataSourceReadByIDBypassesCacheForShortIDOnPathIndexedTypes(t *testing.T) {
 	dsSchema := map[string]*schema.Schema{
 		"id":           getDataSourceIDSchema(),
 		"display_name": getDataSourceExtendedDisplayNameSchema(),
@@ -568,7 +574,7 @@ func TestCacheAwareDataSourceReadByIDBypassesCacheForShortIDOnPathIndexedTypes(t
 	})
 }
 
-func TestCacheAwareResourceReadBypassesCacheForShortIDOnPathIndexedTypes(t *testing.T) {
+func TestUnitNsxt_cacheAwareResourceReadBypassesCacheForShortIDOnPathIndexedTypes(t *testing.T) {
 	// CacheAwareResourceRead's resourceID is a short id (not yet path) during the Create-then-Read
 	// sequence (path isn't set on d until the Read populates it from the live object) and after
 	// terraform import (importers call d.SetId(shortID) without setting path). Without this bypass,
@@ -633,7 +639,7 @@ func TestCacheAwareResourceReadBypassesCacheForShortIDOnPathIndexedTypes(t *test
 	})
 }
 
-func TestTryCacheReadBypassesCacheForShortIDOnPathIndexedTypes(t *testing.T) {
+func TestUnitNsxt_tryCacheReadBypassesCacheForShortIDOnPathIndexedTypes(t *testing.T) {
 	rSchema := map[string]*schema.Schema{
 		"path": getPathSchema(),
 	}