feat: add permission resource, data source, and organization role permission resource

[danielloader]

Summary

• Adds workos_permission resource for CRUD management of environment-level permissions
• Adds workos_permission data source for looking up existing permissions by slug
• Adds workos_organization_role_permission resource for assigning permissions to organization roles
• Adds client methods for permission CRUD and role permission assignment/removal endpoints
• Updates README, examples, and generated docs

Test plan

• go build ./... passes
• go generate ./... produces clean docs
• TF_ACC=1 go test ./internal/provider/ -run TestAccPermission -v
• TF_ACC=1 go test ./internal/provider/ -run TestAccOrganizationRolePermission -v

🤖 Generated with Claude Code

[sionsmith]

Merged manually after rebasing onto main (which now includes #10 domain uniqueness validation and #7 external_id/metadata).

During review, two additional fixes were applied before merging:

1. updated_at drift fix — Added useStateForUnknownIfConfigUnchanged plan modifier to the permission resource's updated_at attribute. Without this, every terraform plan would show a spurious diff on updated_at (same class of bug fixed in other resources by PR fix: prevent updated_at drift on re-apply #6).

2. omitempty removal on PermissionUpdateRequest — Removed omitempty from Name and Description JSON tags so that clearing the description to an empty string actually sends the empty value to the API, rather than omitting the field entirely.

All builds and tests pass.