Feature: standalone topic permission grant

[klevy-toast]

Fixes #161

Motivation

Extends the pulsar_permission_grant resource to add topic permissions.

Modifications

• Modify permission_grant schema to add optional topic field, and enforce ExactlyOneOf validation between topic & namespace fields
• Add CRUD operations for topic permission grants
• Modify topic resource so that it does not make changes to topic permissions that aren't part of the existing terraform state.

Verifying this change

• Make sure that the change passes the CI checks.

(Please pick either of the following options)

This change added tests and can be verified as follows:

• Added tests that use the permission_grant topic CRUD operations
• Added tests that verify schema validation
• Added test to topic resource that verifies that it does not interfere with external permission state

Documentation

• doc

  (If this PR contains doc changes)

[Copilot]

Pull Request Overview

This PR extends the pulsar_permission_grant resource to support topic-level permissions in addition to existing namespace permissions, addressing issue #161.

• Adds topic permission support to the standalone permission grant resource with mutual exclusion validation
• Modifies topic resource to avoid interfering with externally managed permissions
• Includes comprehensive test coverage for topic permissions and validation scenarios

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pulsar/resource_pulsar_permission_grant.go	Adds topic field with ExactlyOneOf validation and implements CRUD operations for topic permissions
pulsar/resource_pulsar_permission_grant_test.go	Adds comprehensive test coverage for topic permissions, validation, and update scenarios
pulsar/resource_pulsar_topic.go	Modifies to use filtered permission setting to avoid conflicts with external permissions
pulsar/resource_pulsar_topic_test.go	Adds test to verify topic resource doesn't interfere with external permission management
pulsar/permission_grant.go	Removes unused setPermissionGrant function
examples/permission_grants/main.tf	Adds topic permission grant examples
docs/resources/permission_grant.md	Updates documentation to reflect topic permission support

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[lhotari]

@freeznet @maxsxu do you have a chance to review?

[lhotari]

Does "Optional" make sense here?

[Copilot]

Pull Request Overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

[nitpick] The regexp import is added but only used in two test functions. Consider grouping imports by standard library, third-party, and local packages for better organization.

[Copilot]

The error message pattern uses regex wildcards that may be too permissive. Consider using a more specific pattern like only one of .* can be specified to avoid false matches.

Suggested change

	ExpectError: regexp.MustCompile(`only one of .*namespace,topic.* can be specified`),
	ExpectError: regexp.MustCompile(`^only one of namespace,topic can be specified$`),

[Copilot]

Similar to the previous regex pattern, this could match unintended text. Consider using a more specific pattern to ensure accurate test validation.

Suggested change

	ExpectError: regexp.MustCompile(`one of .*namespace,topic.* must be specified`),
	ExpectError: regexp.MustCompile(`one of (namespace|topic) must be specified`),