terraform-provider: add missing config-api resources + server-side follow-ups from CI hardening

Follow-ups identified while hardening the `terraform-provider` acceptance suite (PR #14733). The workflow is now green (273/273, 0 skipped); the items below are out of that PR's scope.

## A. Missing config-api resources (net-new, resource-worthy)
Provider coverage of config-api is otherwise complete. These endpoints exist in the swagger but have no provider resource:

- **jans-link** — `GET/PUT /jans-link/link-config` (cache-refresh/LDAP sync config singleton)
- **lock** — `GET/PUT/PATCH /lock/lockConfig` (Jans Lock config singleton)
- **admin-ui** — `GET/PUT/POST/DELETE /admin-ui/webhook` (webhook CRUD collection)
- **admin-ui** — `GET/PUT /admin-ui/config` (admin-ui config singleton)
- **admin-ui** — `GET/PUT /admin-ui/security/policyStore` (Cedarling policy store)
- **agama** — `GET/PUT /api/v1/agama-deployment/configs/{name}` (per-flow deployment config)

Lower priority (actions/read-only, not resources): health probes, `/config/smtp/test`, `/config/database/ldap/test`, cache sub-configs (already managed via the parent `/config/cache` PATCH), fido2 metrics/trust reads, agama-repo download, session search, license actions.

## B. Server-side / AIO env issues found (not provider bugs)
These blocked tests that were removed/trimmed rather than skipped; they need a server or AIO-image fix:

- `PUT /jans-config-api/api/v1/jans-assets/upload` returns 500 on the AIO (asset update); create/get/delete work. Provider `UpdateJansAsset` is correct.
- admin-ui RBAC endpoints (`/jans-config-api/admin-ui/adminUI*`) return 404 on the AIO — the admin-ui plugin REST application does not appear to be served, even though the plugin is listed as loaded.
- SCIM `GET /jans-scim/restv1/v2/Fido2Devices` returns a server-side 500 (matches known pre-existing SCIM failures).
- config-api `POST /api/v1/attributes` returns 500 (not 406) for an arbitrary custom-attribute name on the SQL backend, with no server log.

---
**Update (asset PUT 500 — root cause + provider workaround applied):** The exact server error is:
```
ERROR rest.resource.auth.AssetResource AssetResource.java:440-
Application Error while updated asset is:
Provided filePath [//opt/jans/jetty/jans-auth/custom/i18n] does not match the one defined in config [/opt/jans/jetty/jans-auth/custom/i18n] !
```
config-api stores `filePath` with a leading double slash (`//opt/...`) on create, then rejects that same value on update via an exact string match against the single-slash config path. Server-side path-build bug. Provider workaround landed in PR #14733 (normalize the leading `//` before PUT); the underlying config-api double-slash should still be fixed.