feat(certificatemanager): add Certificate and CertificateMapEntry

[naxty]

The rest of the free surface of this service, taking it from three types to five.

Type	Case	CRUD	Discovery
GCP::CertificateManager::Certificate	certmanager-certificate	8/8	4/4
GCP::CertificateManager::CertificateMapEntry	certmanager-certificate-map-entry	8/8	4/4

Verified locally against the same service account CI uses. A managed
certificate carries no private key, so the case describes one without committing
key material — it never leaves PROVISIONING, because example.com is not ours,
and no phase depends on it doing so. CertificateIssuanceConfig is left out: it
needs a CA pool, which bills.

Four things the API forced

Each found by probing it, not by reading docs.

managed is not a name a forma can use. It is a fixed property of
formae.Resource, and a resource redeclaring it does not evaluate. The schema
calls it managedCertificate; the plugin renames it in both directions, and
those two transformers are the only places that know.

A reference resolves short; the API speaks in paths. A forma names another
resource by short id — that is all a resolvable yields — while the API wants a
full path and answers with one, carrying the project number where the forma
used the project id. So the request expands and the response shortens.

Doing only the first half is worse than doing neither: the declared side
stays short, state holds a path, and since both fields are immutable every
re-apply plans a replacement of a certificate that a map entry still
references — which the API then refuses. That is exactly how this failed before
the response half existed, and a unit test now pins the round trip as the
identity.

Output-only fields nested inside managed. state and
authorizationAttemptInfo describe issuance progress. A schema hint is only
emitted for a top-level field, so a nested one can never be marked
hasProviderDefault, and Verify rejects it as undeclared. They are dropped on
read.

A parentless List addressed a collection that does not exist, so the entry
was never discovered. Certificate Manager accepts - as a wildcard parent,
enumerating entries across every map in one call — cheaper than the walker the
same problem needed in Service Directory and Cloud SQL.

Deleting a DnsAuthorization while a certificate still references it is reported
as retryable rather than fatal: the certificate's own delete is a
long-running operation, so the refusal is a race that clears itself. Same
treatment Cloud SQL gives a database whose sessions have not been reaped.

Also: the Certificate Manager sweep did not exist

These resources accumulated through the session — certificates, maps and
authorizations left by conformance runs — because clean-environment.sh had no
section for them. Added, in dependency order (an entry pins its map and its
certificate; a certificate pins its authorization), and verified against the
live project by using it to clear what this work left behind: 3 certificates,
3 maps and 7 authorizations down to zero.