certificatemanager: support in-place update of self_managed certificate data

[modular-magician]

Description

google_certificate_manager_certificate currently forces recreation whenever a self-managed certificate's data changes, because the self_managed block and its pem_certificate / pem_private_key fields (and the deprecated certificate_pem / private_key_pem aliases) are marked immutable.

As reported in hashicorp/terraform-provider-google#17312, this makes rotating a self-managed certificate very painful in practice: the certificate is typically in use by a google_certificate_manager_certificate_map_entry and, transitively, a load balancer, so the delete-then-create cycle fails and the update cannot be applied.

The Certificate Manager API already supports updating self-managed certificate data in place via the certificates.patch method with updateMask=self_managed — this is exactly what gcloud certificate-manager certificates update --certificate-file --private-key-file does.

This PR removes immutable from the self_managed block and its subfields. The resource already declares update_verb: PATCH, update_mask: true, and an async update action, so this simply wires the self-managed certificate data into the existing update path. name, location, scope, and the managed block remain immutable.

A create + update sample step is added (backed by a second, matching cert/key fixture pair) so the generated acceptance test exercises the in-place update and confirms it no longer forces recreation.

I verified locally with go run . --product certificatemanager --output ... --version ga that the generated resource drops ForceNew on self_managed and that the update function appends selfManaged to updateMask on change; the generated _generated_test.go now performs create (cert.pem) → update (cert-updated.pem) with import verification at each step.

Fixes hashicorp/terraform-provider-google#17312

certificatemanager: added in-place update support for the `self_managed` certificate data (`pem_certificate` / `pem_private_key`) on `google_certificate_manager_certificate`; changing the certificate data is now applied via update instead of forcing recreation

Derived from GoogleCloudPlatform/magic-modules#18257