fix: prevent panic on nil Response in AugmentVariableClientError

AugmentVariableClientError dereferenced httpErr.Response.StatusCode without a nil check. On a 404, go-gitlab returns the shared ErrNotFound sentinel, whose Response field is nil, so any masked variable create/ update against a non-existent group/project (or any other 404) crashed the provider with a nil pointer dereference instead of surfacing a clean diagnostic. Read the status from the top-level httpErr.StatusCode field, which is always populated, mirroring the existing nil-safe check in isRefreshError. Add table-driven tests covering the nil-Response sentinel (wrapped and unwrapped) alongside the existing matched and unmatched error paths.