[BUG] ResourceController.updateResource bypasses all bean validation (@Valid missing on @RequestBody)

- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java:152`
- description: `createResource` (line 136) uses `@Valid @RequestBody final CreateResourceDTO`, but `updateResource` (line 152) uses only `@RequestBody final ResourceDTO resourceDTO` with no `@Valid`. `ResourceDTO` declares 11 constraints (`@NotBlank` on parentId/title/name/url/component/icon/perms; `@NotNull` on resourceType/sort/isLeaf/isRoute/status). None are enforced on the update path.
- impact: An authenticated user with `system:resource:editMenu`/`editButton` can update a resource with empty/null required fields, corrupting the menu/permission tree and potentially breaking RBAC enforcement (perms drives authorization checks).
- suggested_fix: Add `@Valid` to the `@RequestBody` parameter on line 152, mirroring `createResource`.
- confidence: High
- related_existing: none — distinct from GOV-T1 (zero-test controllers) and SEC-13 (AppAuthVO plaintext).

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Read shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java around lines 136 and 152, comparing the createResource and updateResource parameter annotations. Verify that updateResource applies the same validation behavior to ResourceDTO as createResource, including its declared required-field constraints.

Written by the indexing model from the issue text.