Mark active and revoked unknown when a token rotates

What does this MR do and why?

When a token with rotation_configuration is due to rotate, ModifyPlan marks id, token and created_at unknown but left active and revoked at the values copied from state. For a token that had expired the plan therefore promised active = false, the replacement came back active, and Terraform rejected the apply with "Provider produced inconsistent result after apply: .active: was cty.False, but now cty.True". A second apply succeeds because state has caught up by then. The same applies to a token revoked before rotation.

This MR marks both attributes unknown in the shared ApplyTokenRotation helper and adds the two setters to the RotatableToken interface, so the personal, project, group and both service-account token resources all get the fix. The helper's unit test asserts the unknowns on rotation and that untouched plans are left alone.

Related issues

Resolves #6879 (closed)

How to test

1. Apply a gitlab_project_access_token with rotation_configuration { expiration_days = 1, rotate_before_days = 1 }, wait for expiry, and apply again.
2. On main the apply fails with the inconsistency error; with this MR it rotates and records active = true.
3. go test ./internal/provider/utils -run TestApplyTokenRotation.