direct: Add support for secret scopes

[shreyas-goenka]

Changes

Adds direct deployment support for secret scopes with restructured acceptance tests and fixed local mock server.

Mock Server Fix

Fixed libs/testserver/secret_scopes.go to automatically grant MANAGE permission to the creator when a scope is created, matching real Databricks behavior. This ensures local tests accurately simulate cloud behavior.

Tests

New local and cloud acceptance tests.

[eng-dev-ecosystem-bot]

Run: 19247862713

	Env	🪲​BUG	🟨​KNOWN	🔄​flaky	🙈​SKIP	✅​pass	🙈​skip
🪲​	aws linux	3	1		1	358	601
🪲​	aws windows	3	1		1	359	600
🪲​	aws-ucws linux	3	1		1	493	492
🪲​	aws-ucws windows	3	1		1	494	491
🪲​	azure linux	3	1		1	358	600
🪲​	azure windows	3	1	2	1	357	599
🪲​	azure-ucws linux	3	1		1	489	491
🪲​	azure-ucws windows	3	1		1	490	490
🪲​	gcp linux	3	1	1	1	356	602
🪲​	gcp windows	3	1	2	1	356	601

10 failing tests:

Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
TestAccept	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K	🟨​K
TestAccept/bundle/resources/secret_scopes/permissions	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B
TestAccept/bundle/resources/secret_scopes/permissions/DATABRICKS_BUNDLE_ENGINE=direct	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B
TestAccept/bundle/resources/secret_scopes/permissions/DATABRICKS_BUNDLE_ENGINE=terraform	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B	🪲​B
TestAccept/bundle/run/app-with-job	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
TestAccept/bundle/templates/default-python/combinations/serverless	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f	✅​p
TestAccept/bundle/templates/default-python/integration_classic	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f
TestAccept/bundle/templates/default-python/integration_classic/DATABRICKS_BUNDLE_ENGINE=terraform/UV_PYTHON=3.11	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f
TestFilerWorkspaceNotebook	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f	✅​p	✅​p	✅​p	✅​p
TestFilerWorkspaceNotebook/pythonJupyterNb.ipynb	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f	✅​p	✅​p	✅​p	✅​p

[shreyas-goenka]

Newly added tests give more than enough coverage for this. (see basic test)

[shreyas-goenka]

We only run it on cloud because there's ordering issues in the permissions returned by GET that are not worth dealing with (because of the different user names, there is no stable sort).

[shreyas-goenka]

Field triggers apply to the output of PrepareState, not the input.