Parse gitlab_group_ldap_link IDs whose filter or CN contains a colon

What does this MR do and why?

The gitlab_group_ldap_link ID is <group>:<ldap_provider>:<cn>:<filter>, and resourceGitLabGroupLDAPLinkParseId splits it on every colon and requires exactly four parts. LDAP filters often contain colons, for example the Active Directory "in chain" matching rule in (memberOf:1.2.840.113556.1.4.1941:=CN=devs,OU=Groups,DC=example,DC=com), and a CN can contain one too. For such a link, Create adds it in GitLab and then fails in the Read that follows with unexpected ID format: Group LDAP Link ID did not split into 4 parts. Read and Delete fail the same way on every later run, so the link stays in GitLab while Terraform can neither refresh nor destroy it.

This MR splits off only the group and the LDAP provider. GitLab requires a link to have either a CN or a filter, never both, so the rest of the ID is <cn>: or :<filter>. The ID format does not change, and the ID of a link without a colon in its CN or filter parses as before, so no state migration is needed. A CN that starts with a colon would still be read as a filter; telling those apart would need a new ID format.

Related to #6682 (closed), which reported the same error after a successful create and was closed without a reproduction. The filter posted there has no colon, so it may have had another cause. !3030 (closed) (closed) used strings.SplitN(id, ":", 4) when it moved this resource to the plugin framework, which fixes a filter but not a CN with a colon.

How to verify

TestAccGitlabGroupLdapLink_colonInFilterOrCN creates a link with the matching rule filter and imports it, replaces it with a link whose CN is devs:admins, checks that the filter link is gone, and imports the new one. LDAP links need EE (testutil.SkipIfCE), so the CE jobs skip it:

make testacc-up SERVICE=gitlab-ee
make testacc RUN=TestAccGitlabGroupLdapLink_

What I ran (GitLab EE 19.5.0, Go 1.26.10, Terraform 1.4.0, golangci-lint 2.15.0)

Against a GitLab EE 19.5.0 with an Ultimate trial license, set up with scripts/healthcheck-and-setup.sh, the new test fails on main in its first step, and the destroy after it fails the same way:

Step 1/4 error: Error running apply: exit status 1

Error: unexpected ID format: Group LDAP Link ID did not split into 4 parts. Expected <group>:<LDAPProvider>:<CN>:<filter>, got 34:default::(memberOf:1.2.840.113556.1.4.1941:=CN=devs,OU=Groups,DC=example,DC=com)

Error running post-test destroy, there may be dangling resources: exit status 1

With this change it passes, and so do the other nine TestAccGitlabGroupLdapLink_ tests. It also fails with strings.SplitN(id, ":", 4) in place of the change (the CN step ends in Provider produced inconsistent result after apply), and with either of the two branches removed. make build, gofmt -s, go vet -tags acceptance, make lint-golangci (0 issues), make lint-tfprovider, make lint-examples-sh, make lint-examples-tf, make lint-custom, make generate (no diff) and make test are clean.

This work comes from maintaining gitlab-mcp-server, whose upstream-bugs.md records everything done on its dependencies and sibling projects.