SCIM Provider User/Group diff does not work

### Describe the bug

Hi,

the SCIM provider assumes that the *response* of the SCIM server will contain the exact same data as the request payload.

RFC 7643 is very specific about the service provider being allowed to ignore attributes:

> For example, a
SCIM service provider, upon receiving a request to replace an
existing resource with a replacement JSON object, evaluates each
asserted attribute based on its characteristics as defined in the
relevant schema (e.g., mutability) and decides which attributes may
be replaced or **ignored**.

Additionally attributes may be readOnly:

>
mutability A single keyword indicating the circumstances under
which the value of the attribute can be (re)defined:

readOnly The attribute SHALL NOT be modified.
....

writeOnly The attribute MAY be updated at any time. Attribute
values SHALL NOT be returned (e.g., because the value is a
stored hash). Note: An attribute with a mutability of
"writeOnly" usually also has a returned setting of "never".

Meaning the server can generate attributes that the client never is able to send (readOnly) or the server does not return certain values (writeOnly).

So this patch completely ignores the reality of the SCIM RFC and thus SCIM providers always run full syncs.

The unit test for this only works because it tests that the SCIM connection object contains the same payload as authentik has sent. This is an invalid test.

Reopens: https://github.com/goauthentik/authentik/issues/17857
Caused by: https://github.com/goauthentik/authentik/pull/18456

### How to reproduce

Use SCIM with a SCIM server that does not return exactly the same data as in the request.

### Expected behavior

Authentik should use a concurrency versioning model (https://django-concurrency.readthedocs.io/en/latest/index.html#django-concurrency).

That way it'd be possible to tell which object even changed by comparing against a version field in the SCIMConnection.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.12

### Relevant log output

```shell

```

Start with the SCIM provider diff logic and the unit test that currently asserts the SCIM connection contains the exact payload sent by authentik. Read the RFC 7643 behavior described in the issue, then establish how SCIMConnection versioning should identify changes. Done means differing responses, including ignored, readOnly, or writeOnly attributes, no longer force full syncs and the invalid test is replaced.

Written by the indexing model from the issue text.