[BREAKING CHANGE] split configuration/policy group resources into group + devices resources

[tzarski0]

Split configuration/policy group resources into group + devices resources

Summary

sdwan_configuration_group and sdwan_policy_group previously managed the group and all device
associations, variables, and deployment in one resource — forcing every device onto the same group into
a single state file. This splits each into two resources:

• sdwan_configuration_group / sdwan_policy_group — group-only (name, description, solution, feature
  profiles, topology [config only], feature_versions/policy_versions). Gained a computed version
  attribute that increments on any change, used as a redeploy trigger by the new devices resource. Delete
  now fails if devices are still associated (forces *_devices to be destroyed first).
• sdwan_configuration_group_devices / sdwan_policy_group_devices (new) — device association, variables,
  and deploy. References the group via configuration_group_id/policy_group_id and an optional
  configuration_group_version/policy_group_version to trigger redeployment when the group changes.

This lets one group's devices be split across many state files (e.g. one state per device, ~2000 devices)
without one state affecting devices managed by another — the core mechanism is a state-scoped Read that
only ever reports/touches devices already tracked in that resource's state.

BREAKING CHANGE: the devices block and inline variable/deploy handling are removed from
sdwan_configuration_group/sdwan_policy_group. Existing configs must migrate those blocks to the new
*_devices resources (composite import supported: group_id,[dev1,dev2,...]).