Webex SCIM sync does not remove roles after authentik group membership changes

## Description

When using the SCIM provider, removing a user from an authentik group does not remove the corresponding role in Webex.

For example, authentik groups can be mapped to Webex roles through the SCIM `roles` attribute:

```python
role_mapping = {
"AUTHENTIK-GROUP1": {"value": "id_full_admin", "type": "cirole"},
"AUTHENTIK-GROUP2": {"value": "id_readonly_admin", "type": "cirole"},
"AUTHENTIK-GROUP3": {"value": "id_user_admin", "type": "cirole"},
}
```

## Steps to reproduce

1. Configure a Webex SCIM provider.
2. Map two authentik groups to two Webex roles.
3. Assign a user to both groups and synchronize the user to Webex.
4. Confirm that both roles are assigned in Webex.
5. Remove the user from one of the authentik groups.
6. Run the SCIM synchronization again.

## Expected behavior

authentik sends an updated `PUT /Users/{id}` request to Webex containing the reduced `roles` list. Webex removes the role associated with the deleted group membership.

## Actual behavior

No update is sent, and the role remains assigned to the user in Webex.

The issue appears to originate from `SCIMUserClient.diff()`:

```python
local_updated = {}
MERGE_LIST_UNIQUE.merge(local_updated, local_known)
MERGE_LIST_UNIQUE.merge(local_updated, local_created)
```

The newly generated state is merged with the previously stored Webex state. Consequently, roles found only in `local_known` are retained.

For example, changing the desired Webex roles from:

```json
["id_full_admin", "id_readonly_admin"]
```

to:

```json
["id_full_admin"]
```

produces no detected difference, causing authentik to skip the Webex update.

## Suggested resolution

Make the SCIM comparison replacement-aware for attributes managed by the outgoing payload, including reduced or empty lists, while continuing to ignore server-generated or read-only Webex attributes.

Start at SCIMUserClient.diff(), focusing on how MERGE_LIST_UNIQUE combines local_updated, local_known, and local_created. Reproduce the two-role-to-one-role change from the issue and inspect existing SCIM tests for comparison behavior. Done means a reduced or empty managed roles list produces an updated PUT while server-generated or read-only attributes remain ignored.

Written by the indexing model from the issue text.