Refuse changing a deployment's open_to_public after creation

A deployment's open_to_public (is_public in the legacy model-service responses) reaches AppProxy only when the endpoint is first registered. The update paths still accept it and write endpoints.open_to_public, so after a change the deployment node reports a visibility the proxy does not enforce.

**Why the change never reaches the proxy**

- DeployingInitializingHandler registers only deployments whose network.url is unset; once the URL is persisted, later deploys skip registration.
- AppProxyClient has no call that updates an endpoint's settings — only create, delete, route and token calls.

**Paths that write it today**

- v2 update: REST v2 and GQL updateDeployment — UpdateDeploymentInput.open_to_public → DeploymentUpdater.open_to_public
- Legacy GQL modify_endpoint — EndpointModifier.open_to_public

**Change**

- Refuse an update request that sets open_to_public with InvalidAPIParameters. Creation keeps accepting it.
- Mark the update input field deprecated in GQL and REST v2 (deprecation reason starts with "Deprecated since .").
- Drop open_to_public from DeploymentUpdater and EndpointModifier so no path can write it after creation.

**Acceptance**

- Updating open_to_public through v2 update or legacy modify_endpoint is refused; other fields in the same request are not applied.
- The deployment scenario row that opens a deployment to the public on update is replaced by a refusal row; the deployment KNOWLEDGE.md and report.md follow.

JIRA Issue: BA-7864

Start with DeployingInitializingHandler, AppProxyClient, DeploymentUpdater, EndpointModifier, and the v2 and legacy GraphQL update entry points named in the issue. Trace the update validation and scenario coverage, then update the relevant deployment KNOWLEDGE.md and report.md; done means both update paths refuse open_to_public without applying other fields, while creation still accepts it.

Written by the indexing model from the issue text.