msgraph_resource_action: native when=destroy option for endpoints that only support create (like connectorGroup/$ref)

Use case

Microsoft Graph's Application Proxy connectorGroup relationship only officially supports PUT (docs: https://learn.microsoft.com/en-us/graph/application-proxy-configure-api?tabs=http, step 3.4 — only a PUT example is documented, no GET/DELETE/PATCH):

PUT https://graph.microsoft.com/beta/applications/{id}/connectorGroup/$ref
Content-type: application/json

{
  "@odata.id":"https://graph.microsoft.com/beta/onPremisesPublishingProfiles/applicationproxy/connectorGroups/{groupId}"
}

We want to assign this on create and unassign it (DELETE .../connectorGroup/$ref, which does work in practice even though undocumented) when the surrounding Terraform resource is destroyed.

What we tried

• msgraph_resource (a real stateful resource with a proper Delete lifecycle) seemed like the right fit, since it does issue a real DELETE on destroy. But its Create unconditionally calls consistency.WaitForUpdate against ResourceExistenceFunc, which for a /$ref URL calls ListRefIDs on the collection URL. Since GET/listing isn't supported for this endpoint, that call 404s forever, the existence check never turns true, and Create hangs until the default 30-minute create timeout. There's no way to configure this check off.
• msgraph_resource_action avoids this entirely (fire-and-forget, no read-after-create), but it has no destroy-time hook at all — it only ever fires its request on create.

Request

A native way to run a msgraph_resource_action-style one-shot request only at destroy time, without any read-after-create/consistency polling — similar to azapi_resource_action's when argument (create/destroy, see https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource_action):

resource "azapi_resource_action" "example" {
  # ...
  when = "destroy"
}

This would let us model create-only-supported, $ref-style Graph relationships (assign on create via PUT, unassign on destroy via DELETE) without hitting the ListRefIDs/WaitForUpdate hang described above, and without needing an external HTTP client via a local-exec provisioner (not available in our CI apply environment).

Provider version

microsoft/msgraph 0.5.0

Start by reading the msgraph_resource_action lifecycle and the msgraph_resource Create path, especially consistency.WaitForUpdate and ResourceExistenceFunc. Compare the requested behavior with azapi_resource_action's when argument. Done means a destroy-only action can issue DELETE without read-after-create or consistency polling, while preserving create behavior.