feat(ipa): Tighten standard method guarantees in IPA-101, IPA-106, IPA-107 and IPA-108

[AgustinBettati]

Tightens standard-method guarantees from should to must and adds two lifecycle rules, so declarative clients can rely on field round-trip parity and predictable delete behavior.

• IPA-101 — every field accepted in a request body must also appear in the response (sensitive fields excepted); and resources declared by clients must not be silently removed by the server (model lifecycle transitions as a terminal status, e.g. EXPIRED/REVOKED).
• IPA-106 / IPA-107 — Create/Update response must (was should) be the same resource returned by Get; Update must return the complete resource.
• IPA-108 — Delete must succeed iff the resource was deleted, must 404 on non-existent, and must not return success while internal state without an independent endpoint remains.

Note: the IPA-101 round-trip bullet links to the Sensitive Fields anchor added in #77 — merging that first resolves the anchor (build only warns until then).

Ticket: CLOUDP-412563