Generalise validating changes to properties during an update

### User Story

As a user of Sleeper, I want the system to warn or stop me when I make a dangerous change, so that I don't break something.

### Description / Background

Under epic:
- https://github.com/gchq/sleeper/issues/3693

Related to:
- https://github.com/gchq/sleeper/issues/3627
- https://github.com/gchq/sleeper/issues/5870

Whenever instance properties or table properties are updated, we'd like the changes to be validated consistently, and prevent any unintentional or accidental changes that could have lasting consequences.

### Acceptance Criteria

**When** I make a change to the instance properties or table properties in the admin client
**And** I make the same change in an identical instance programmatically
**And** I make the same change in an identical instance through the CDK
**Then** the change should be validated in the same way

The validation applied when a property is changed in the admin client should be applied to all updates.
Only the CDK should be able to set or change the CDK-defined properties.
The CDK should still be explicit about a create or update, with failures based on drift.
If the table ID is present in table properties to be written to the instance, this should fail validation.

### Technical Notes / Implementation Details

For table properties, we have TablePropertiesStore that every operation against the table properties needs to go through. This might be a reasonable place to add the validation.

We'll need to move the validation logic that is currently in the admin client, called from InstanceConfigurationScreen. This uses PropertiesDiff and UpdatePropertiesRequest.

For instance properties, we don't have an equivalent to TablePropertiesStore. Instead we just use `S3InstanceProperties.saveToS3`. We can introduce an equivalent to TablePropertiesStore where we have more specific update types (create, update, save), and validate changes during an update.

Start by reading the validation flow from InstanceConfigurationScreen, including PropertiesDiff and UpdatePropertiesRequest, and inspect how TablePropertiesStore and S3InstanceProperties.saveToS3 handle writes. Trace the create, update, and save paths for instance and table properties; the work is done when equivalent admin, programmatic, and CDK updates apply the same validation and the listed invalid changes fail.

Written by the indexing model from the issue text.