fix: don't send masked on update for hidden project/group variables

Summary

gitlab_project_variable and gitlab_group_variable's Update() always sent masked in the API request, even when the variable is already hidden. GitLab rejects any masked value on update once a variable is hidden ("The visibility setting cannot be changed for masked and hidden variables"), since there's no way to express masked_and_hidden on an update call — only on create. Create() already special-cased hidden variables; Update() never did, so any apply that touched an existing hidden variable's other attributes (e.g. rotating its value) failed with a 400.

Fix: omit masked from the update payload whenever the variable is hidden.

Also, while in the area:

• Moved boolOrNilIfUnknown/stringOrNilIfUnknown out of resource_gitlab_group_integration_datadog.go into internal/provider/utils as BoolOrNilIfUnknown/StringOrNilIfUnknown, plus a new BoolIsTrue helper, all with unit tests.

Test plan

• go build ./...
• go vet ./... and go vet -tags acceptance ./...
• go test ./... (unit tests, including new utils.BoolIsTrue/BoolOrNilIfUnknown/StringOrNilIfUnknown tests)
• Added TestAccGitlabProjectVariable_updateHiddenVariableValue / TestAccGitlabGroupVariable_updateHiddenVariableValue acceptance tests reproducing the regression (create hidden+masked variable, update its value without reconfiguring hidden/masked, expect a plain update - not requiring or forcing a replace)
• Acceptance tests not run in this environment (require TF_ACC=1 and a real GitLab instance/token)