[AWS::BedrockAgentCore::Gateway] - [Bug] - UpdateResource fails with ValidationException when AllowedClients/AllowedScopes were not set at creation

## Summary

`AWS::BedrockAgentCore::Gateway` cannot be updated via CloudControl API once created, if `AllowedClients` or `AllowedScopes` were not provided at creation time. Any subsequent `UpdateResource` call — even one that does not touch `AuthorizerConfiguration` at all — fails with:

```
ValidationException: AllowedClients minimum 1, found 0
ValidationException: AllowedScopes minimum 1, found 0
```

## Root Cause

The CloudControl handler for `AWS::BedrockAgentCore::Gateway` persists `AllowedClients` and `AllowedScopes` as `[]` (empty arrays) when the gateway is created without those fields. Both fields are defined as optional in the resource schema (`required` only contains `DiscoveryUrl`) but carry a `minItems: 1` constraint:

```json
"AllowedClients": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
"AllowedScopes": { "type": "array", "items": { ... }, "minItems": 1 }
```

On any subsequent `UpdateResource` call, the handler validates the **full stored resource model** against the schema — not just the fields in the patch. The stored `[]` values fail `minItems: 1`, blocking all gateway updates.

This is a self-referential contract violation: the handler stores `[]` for an optional field, then rejects its own stored value on the next update.

## Reproduction

1. Create a gateway without `AllowedClients`/`AllowedScopes` in `AuthorizerConfiguration`:

```json
{
"Name": "my-gateway",
"RoleArn": "arn:aws:iam::123456789012:role/my-role",
"ProtocolType": "MCP",
"AuthorizerType": "CUSTOM_JWT",
"AuthorizerConfiguration": {
"CustomJWTAuthorizer": {
"DiscoveryUrl": "https://example.auth0.com/.well-known/openid-configuration",
"AllowedAudience": ["my-audience"]
}
}
}
```

2. After creation succeeds, call `UpdateResource` with any change — e.g. add `PolicyEngineConfiguration`. The patch does not touch `AuthorizerConfiguration`.

3. `UpdateResource` fails:

```
ValidationException: Model validation failed
#/AuthorizerConfiguration/CustomJWTAuthorizer/AllowedClients: expected minimum item count: 1, found: 0
#/AuthorizerConfiguration/CustomJWTAuthorizer/AllowedScopes: expected minimum item count: 1, found: 0
```

## Impact

- All Terraform users of `awscc_bedrockagentcore_gateway` who do not set `AllowedClients`/`AllowedScopes` at creation are permanently blocked from updating their gateway via Terraform (tracked at hashicorp/terraform-provider-awscc#3186).
- Any CloudControl API consumer (CDK, CloudFormation stacks) is affected the same way.
- The only workaround is to destroy and recreate the gateway, or to use `ignore_changes` in Terraform — both are disruptive.

## Expected Behavior

Either:

1. The CloudControl handler should NOT persist `[]` for optional array fields with `minItems: 1` when they are not provided at creation. Store `null`/absent instead.
2. OR: `UpdateResource` should validate only the fields included in the patch, not the full stored model.
3. OR: `AllowedClients`/`AllowedScopes` should be added to `createOnlyProperties` if they are truly immutable, so tooling can correctly signal destroy-recreate instead of attempting an in-place update.

## Additional Context

- `AllowedClients` and `AllowedScopes` are NOT in `createOnlyProperties` in the current CloudFormation schema, indicating AWS intends them to be mutable.
- The same `minItems: 1` constraint on `AllowedAudience` (also optional) may be affected.
- Verified against CloudFormation schema version bundled in `hashicorp/terraform-provider-awscc` v1.85.0.

Start with the CloudControl API handler and the CloudFormation schema described in the issue, then reproduce an update after creating a gateway without AllowedClients or AllowedScopes. Trace how omitted optional arrays become stored values and how the full model is validated; done means the reported update path no longer fails while the intended schema and mutability behavior remain consistent.

Written by the indexing model from the issue text.