az containerapp env update --dns-suffix is silently ignored (dnsSuffix never sent in PATCH)

### Describe the bug

`az containerapp env update --dns-suffix --certificate-file --certificate-password `
reports success (HTTP 200) but the custom DNS suffix is **never applied**. After the command,
`az containerapp env show ... --query properties.customDomainConfiguration` returns
`dnsSuffix: null` (and `certificateValue/thumbprint` also null).

Inspecting the outgoing PATCH request body shows `customDomainConfiguration` contains
`certificateValue` / `certificatePassword` / `certificateKeyVaultProperties`, but **no `dnsSuffix`** —
so the `--dns-suffix` value is silently dropped on update.

### Root cause (source)

In `src/containerapp/azext_containerapp/containerapp_env_decorator.py`:

- The **create** decorator `ContainerappEnvPreviewCreateDecorator._set_up_custom_domain_configuration()`
correctly sets `custom_domain["dnsSuffix"] = self.get_argument_hostname()`.
- The **update** decorator `ContainerappEnvPreviewUpdateDecorator.set_up_custom_domain_configuration()`
only does:
```python
safe_set(self.managed_env_def, "properties", "customDomainConfiguration", "certificateValue", value=blob)
safe_set(self.managed_env_def, "properties", "customDomainConfiguration", "certificatePassword", value=...)
safe_set(self.managed_env_def, "properties", "customDomainConfiguration", "certificateKeyVaultProperties", value=None)
```
It **never sets `dnsSuffix`** and never reads `--dns-suffix` (the `hostname` argument). As a result
`--dns-suffix` is a no-op on `env update`.

This is still present on the `main` branch as of 2026-06-17.

### To Reproduce

1. Create a Container Apps environment (e.g. internal or external).
2. Run:
```bash
az containerapp env update \
--name --resource-group \
--dns-suffix example.contoso.com \
--certificate-file ./cert.pfx \
--certificate-password
```
3. Check the result:
```bash
az containerapp env show --name --resource-group \
--query properties.customDomainConfiguration
```
`dnsSuffix` is `null` (the certificate fields are also not effectively applied because the
configuration is incomplete).

### Expected behavior

`customDomainConfiguration.dnsSuffix` is set to the value passed via `--dns-suffix`, exactly as it is
on `az containerapp env create`.

### Suggested fix

In `ContainerappEnvPreviewUpdateDecorator.set_up_custom_domain_configuration()`, set the suffix when
provided, e.g.:

```python
if self.get_argument_hostname():
safe_set(self.managed_env_def, "properties", "customDomainConfiguration",
"dnsSuffix", value=self.get_argument_hostname())
```

### Environment

- containerapp extension: **1.3.0b4** (bug also present on `main`)
- azure-cli: 2.87.0
- OS: Windows

### Workaround

Set the custom DNS suffix at `az containerapp env create` time, or via a direct REST `PATCH`:

```bash
az rest --method patch \
--url "https://management.azure.com/subscriptions/<sub>/resourceGroups//providers/Microsoft.App/managedEnvironments/?api-version=2024-03-01" \
--body '{"properties":{"customDomainConfiguration":{"dnsSuffix":"example.contoso.com","certificateValue":"","certificatePassword":""}}}'
```</sub>

Read src/containerapp/azext_containerapp/containerapp_env_decorator.py, especially ContainerappEnvPreviewUpdateDecorator.set_up_custom_domain_configuration(), and compare it with the create decorator. Run the documented az containerapp env update command, inspect the PATCH body, and verify with az containerapp env show that customDomainConfiguration.dnsSuffix contains the supplied value.

Written by the indexing model from the issue text.