fix: add IsUnknown() checks for Optional+Computed fields

[danielloader]

Summary

• Adds missing IsUnknown() guards on Optional+Computed attributes in the user and organization membership resources
• When these attributes are not set by the user, Terraform marks them as unknown (not null) during planning — the missing check caused Value Conversion Error crashes because native Go types (map[string]string, string) cannot represent unknown values
• Fixes metadata and external_id in resource_user.go, and role_slug in resource_organization_membership.go to match the pattern already used in resource_organization.go

Test plan

• go build ./... passes
• Apply a config that creates a workos_user without setting metadata or external_id — should no longer produce "Value Conversion Error"
• Apply a config that creates a workos_organization_membership with role_slug set — verify it still works as expected
• Apply a config that creates a workos_organization_membership without role_slug — should no longer crash

🤖 Generated with Claude Code

[danielloader]

I've also bolted in a change to undo the unique constant on domains, as with some testing in the Web UI it's possible, and works, to assign domains to multiple organisations and logging into one auto assigns memberships to all of them and that means we shouldn't constrain this in the provider.

[sionsmith]

Thanks for the contribution @danielloader! 🎉 All three fixes in this PR shipped in v2.2.1.

While merging, we noticed one remaining issue: the WorkOS API merges metadata on PUT updates rather than replacing it, so removing metadata keys from a Terraform config didn't actually delete them server-side. This was causing TestAccUserResource_withExternalIDAndMetadata to fail with an "inconsistent result after apply" error on step 3 (metadata key removal).

We followed up with #19 to fix that — both workos_user and workos_organization now send null for removed metadata keys, which is also included in v2.2.1.