feat(BOT-367): Add tenant management to security_zone module

[kvp-hpe]

Summary

Implements BOT-367: Blueprint Enhancement - Tenant management by adding CRUD operations for Apstra Tenant objects to the security_zone module.

Tenants are a distinct entity in Apstra that group routing zones (security zones) under a named label, visible in the Apstra UI under Policies > Tenants.

Changes

New file: plugins/module_utils/apstra/bp_tenants.py

• Utility module for Tenant CRUD via raw_request (Tenant API is not exposed by the SDK)
• Functions: list_tenants, get_tenant, create_tenant, update_tenant, delete_tenant, find_tenant_by_label, resolve_security_zone_ids

Modified: plugins/modules/security_zone.py

• tenant parameter (dict) — manage a single Tenant object with label and optional routing_zones
• tenants parameter (list of dicts) — bulk Tenant operations with per-item state override
• state=list — now returns both security_zones and tenants lists
• Routing zone references can be labels or IDs
• Full idempotency for create, update, and delete
• Mutually exclusive with body parameter to maintain backward compatibility

New file: tests/tenant_management.yml

• 48-task integration test playbook covering all acceptance criteria

Acceptance Criteria

AC	Description	Status
AC-1	Single tenant create/update with routing zones	✅ PASS
AC-2	Bulk tenant create/update/delete	✅ PASS
AC-3	Backward compatibility (tenant_label alias)	✅ PASS
AC-4	Idempotency (create, update, delete)	✅ PASS
AC-5	Integration test playbook	✅ PASS

Testing

• tenant_management.yml: 48/48 tasks passed (0 failures)
• security_zone.yml: 35/35 tasks passed (backward compatibility verified)

API Details

POST   /api/blueprints/{bp_id}/tenants          → create tenant
GET    /api/blueprints/{bp_id}/tenants           → list tenants
GET    /api/blueprints/{bp_id}/tenants/{tid}     → get tenant
PUT    /api/blueprints/{bp_id}/tenants/{tid}     → update (application_node_ids only, label is immutable)
DELETE /api/blueprints/{bp_id}/tenants/{tid}     → delete tenant

Resolves: BOT-367

[alagoutte]

Hi,

There is an issue with this change on ansible sanity :

security_zone.py:0:0: parameter-state-invalid-choice: Argument 'state' includes the value 'list' as a choice

Can you look ? list is not valid type for state https://docs.ansible.com/projects/ansible/latest/dev_guide/developing_modules_best_practices.html#following-ansible-conventions

May be better idea to create fact for this ? https://docs.ansible.com/projects/ansible/latest/dev_guide/developing_modules_general.html?#creating-an-info-or-a-facts-module