Fix credential-provision rotation settings, validation, and delivery handling

[tbjones-ks]

Summary

Fixes and improvements for the credential-provision command based on customer feedback and testing.

Bug Fixes

• Fix rotation settings linking to PAM Configuration instead of PAM Directory when directory_uid is provided
• Fix group assignment success reporting — only show success for groups that actually succeeded
• Send DN instead of username for add-to-group operations
• Remove stale delivery.method references

New Validation

• Validate directory_uid points to a pamDirectory record type
• Validate ad_groups requires directory_uid
• Validate distinguished_name {username} placeholder has a username source
• Warn when delivery.share_to user may not exist in Keeper
• Deprecation check for pam.rotation YAML structure with migration guide
• Deprecation warning for pam_config_uid in YAML — recommend -c flag

Improvements

• Add support for folder UIDs in vault.folder (in addition to folder paths)
• Skip email delivery gracefully when email.config_name is set to none/null
• Add Gateway version check — skip AD operations if Gateway < 1.8.0
• Continue with PAM User creation when AD user already exists instead of failing

Test plan

• Rotation links to PAM Directory when directory_uid provided
• Folder UID accepted in vault.folder
• Email config_name=none skips email with warning
• Gateway version < 1.8.0 skips AD with warning
• AD user already exists continues flow
• Group failures reported accurately
• pam.rotation deprecation message shows
• pam_config_uid deprecation warning shows
• directory_uid wrong record type caught
• ad_groups without directory_uid caught