Scaleway plugin — Network tasks (VPC, Private Networks, Flexible IPs, Security Groups)

## Summary

Implement tasks for [Scaleway VPC & Network](https://www.scaleway.com/en/vpc/) services — including Private Networks, Flexible IPs, and Security Groups. This enables Kestra users to automate network infrastructure provisioning as part of multi-step infrastructure workflows.

## Motivation

Network provisioning is a critical step in infrastructure automation pipelines. Teams deploying Scaleway-based architectures need to create and configure private networks, assign flexible IPs, and manage security group rules before and after deploying compute or database resources. Today this requires manual Console operations or custom shell scripts. Native tasks enable:

- End-to-end infrastructure provisioning: create VPC → deploy instances → attach private network → configure security groups
- Automated cleanup of ephemeral networks after batch jobs complete
- Reproducible network topologies defined as Kestra flow YAML

## Context

Sub-issue of the Scaleway plugin EPIC. Scaleway's network services span multiple API namespaces:
- **VPC** (Private Networks): `https://api.scaleway.com/vpc/v2/regions/{region}/`
- **Flexible IPs**: `https://api.scaleway.com/flexible-ip/v1alpha1/zones/{zone}/`
- **Instance Security Groups**: part of the Instances API at `https://api.scaleway.com/instance/v1/zones/{zone}/security_groups/`

## API Reference

- **Official docs**: https://www.scaleway.com/en/developers/api/ (VPC, Flexible IP sections)
- **Authentication**: `X-Auth-Token: ` header
- **Base URL patterns**:
- VPC: `https://api.scaleway.com/vpc/v2/regions/{region}/`
- Flexible IPs: `https://api.scaleway.com/flexible-ip/v1alpha1/zones/{zone}/`
- Security Groups: `https://api.scaleway.com/instance/v1/zones/{zone}/security_groups/`
- **SDK / client library**: No official Java SDK — use Apache HttpClient 5 + Jackson

## Gradle Dependencies

```groovy
// HTTP client for Scaleway REST API
implementation "org.apache.httpcomponents.client5:httpclient5:5.3.1"

// JSON serialization
implementation "com.fasterxml.jackson.core:jackson-databind:2.17.0"
```

> Use the latest stable versions available on Maven Central.

## Plugin Structure

- **Repository**: `plugin-scaleway`
- **Namespace**: `io.kestra.plugin.scaleway.network`
- **Sub-plugins**: `network`
- **Categories**: `CLOUD`

## Suggested Tasks

1. `AbstractNetwork` — abstract base class with `secretKey`, `region`/`zone` as `Property`
2. `CreatePrivateNetwork` — create a VPC private network in a region
3. `DeletePrivateNetwork` — delete a private network by ID
4. `ListPrivateNetworks` — list private networks in a region
5. `CreateFlexibleIp` — allocate a new flexible (static) IP in a zone
6. `DeleteFlexibleIp` — release a flexible IP
7. `ListFlexibleIps` — list flexible IPs in a zone
8. `AttachFlexibleIp` — attach a flexible IP to a server
9. `CreateSecurityGroup` — create a security group in a zone
10. `CreateSecurityGroupRule` — add an inbound/outbound rule to a security group

## YAML Examples

### Example 1 — Create a private network for an environment

```yaml
id: provision_vpc
namespace: company.platform

inputs:
- id: environment
type: STRING
defaults: staging

tasks:
- id: create_network
type: io.kestra.plugin.scaleway.network.CreatePrivateNetwork
secretKey: "{{ secret('SCW_SECRET_KEY') }}"
region: fr-par
name: "{{ inputs.environment }}-private-net"
tags:
- "env:{{ inputs.environment }}"

- id: log_network
type: io.kestra.plugin.core.log.Log
message: "Private network created: {{ outputs.create_network.networkId }}"
```

### Example 2 — Allocate and attach a flexible IP to a new server

```yaml
id: server_with_static_ip
namespace: company.platform

tasks:
- id: allocate_ip
type: io.kestra.plugin.scaleway.network.CreateFlexibleIp
secretKey: "{{ secret('SCW_SECRET_KEY') }}"
zone: fr-par-1

- id: create_server
type: io.kestra.plugin.scaleway.instance.CreateServer
secretKey: "{{ secret('SCW_SECRET_KEY') }}"
zone: fr-par-1
name: kestra-web-server
commercialType: DEV1-S
image: ubuntu_jammy

- id: attach_ip
type: io.kestra.plugin.scaleway.network.AttachFlexibleIp
secretKey: "{{ secret('SCW_SECRET_KEY') }}"
zone: fr-par-1
flexibleIpId: "{{ outputs.allocate_ip.flexibleIpId }}"
serverId: "{{ outputs.create_server.serverId }}"

- id: log_result
type: io.kestra.plugin.core.log.Log
message: "Server {{ outputs.create_server.serverId }} reachable at {{ outputs.allocate_ip.address }}"
```

### Example 3 — Teardown network resources after a batch job

```yaml
id: cleanup_ephemeral_network
namespace: company.platform

tasks:
- id: list_temp_networks
type: io.kestra.plugin.scaleway.network.ListPrivateNetworks
secretKey: "{{ secret('SCW_SECRET_KEY') }}"
region: fr-par
tags:
- "env:temp"

- id: delete_each
type: io.kestra.plugin.core.flow.ForEach
values: "{{ outputs.list_temp_networks.networks }}"
tasks:
- id: delete_network
type: io.kestra.plugin.scaleway.network.DeletePrivateNetwork
secretKey: "{{ secret('SCW_SECRET_KEY') }}"
region: fr-par
networkId: "{{ taskrun.value.id }}"
```

## Acceptance Criteria

- [ ] `AbstractNetwork` base class with `secretKey`, `region`/`zone` as `Property`
- [ ] `CreatePrivateNetwork`, `DeletePrivateNetwork`, `ListPrivateNetworks` implemented
- [ ] `CreateFlexibleIp`, `DeleteFlexibleIp`, `ListFlexibleIps`, `AttachFlexibleIp` implemented
- [ ] `CreateSecurityGroup`, `CreateSecurityGroupRule` implemented
- [ ] All `Property` fields support Kestra expression language (template rendering)
- [ ] Unit tests with mocked HTTP responses; integration tests against live Scaleway (skipped if credentials absent)
- [ ] `package-info.java` with `@PluginSubGroup(category = PluginSubGroup.PluginCategory.CLOUD)`
- [ ] Build passes with `./gradlew build`

Start in the plugin-scaleway repository by reviewing the existing plugin structure and the AbstractNetwork entry point described in the issue. Use the VPC, Flexible IP, and Instance Security Groups API references to scope the listed tasks, then add package-info.java and mocked HTTP tests. Done means all acceptance-criteria tasks are implemented and ./gradlew build passes.

Written by the indexing model from the issue text.