fix: critical and high-severity defects from full provider review

[fgouteroux]

Fixes the critical and high-severity defects found by a full review of the provider. Each fix ships with a regression test, and every test was mutation-checked: the defect was reintroduced one at a time to confirm the test actually fails without the fix.

only_groups could delete every managed rule group

determineGroupsToManage filters only_groups against the group names found in the configuration and returns only what matched — nil when nothing does. Update then computes groupsToDelete = difference(oldGroups, newManagedGroups), which with an empty set is every group the resource manages: they are deleted from Mimir, the create loop skips all of them, and the apply reports success. CustomizeDiff duplicated the same logic and did not guard it either.

A typo in only_groups was therefore enough to silently destroy a namespace's rule groups. Names that match no group are now rejected at plan time, before anything is deleted.

Two provider panics

• flattenSnsSigV4Config dereferenced *sigV4Config with no nil check while its caller invoked it unconditionally, unlike the guarded http_config beside it. Any sns_configs stored without a sigv4 key — a config written by mimirtool or by hand — crashed the plugin on terraform import or on a data source read.
• parseTime split on : and indexed [1] unconditionally. start_time and end_time are both optional and validateTime returns early on the empty string, so times { start_time = "03:00" } passed validation and then panicked during plan.

Configuration silently dropped

• wechat_configs.api_url was read from data["api_url_url"], a key no schema declares, so the branch never ran: the configured endpoint never reached Mimir and every plan re-added the attribute.
• oauth2.tls_config was declared in the schema and present in the Go struct but never read by expand nor written by flatten, silently weakening TLS on the token request and leaving a permanent diff.

Empty sigv4 block no longer emitted

expandSnsSigV4Config allocated the struct before its guard, so the pointer was never nil, yaml:"sigv4,omitempty" could not apply, and sigv4: {} was written for every sns_configs block — read back as a block the user never wrote, producing a plan that never converges. Allocation now happens inside the guard, matching every other nested block.