feat(cloud): expose complete ClickPipe updates

[sdairs]

Adds cloud clickpipe update <service-id> <clickpipe-id> --config-file FILE|- for the complete current ClickPipe PATCH surface. Typed JSON input covers root fields and all seven supported source arms; omitted fields stay off the wire, explicit false/zero/empty values survive, and BigQuery is rejected because the API has no PATCH arm.

Input is validated before network access, including unknown nested fields, catch-all enum values, required nested MySQL/MongoDB/Pub/Sub fields, Kafka credential unions and authentication correspondence, multiple source providers, and empty no-op bodies. Kafka IAM role and workload identity updates omit credentials, while CA-only and reverse-private-endpoint-only updates no longer require fabricated credential data. The command uses the existing typed API method through an organization-aware CloudClient wrapper, is classified as a write for OAuth fail-fast behavior, and renders both JSON and human responses.

Tests cover file/stdin parsing, minimal and maximal builders, exact real-binary PATCH bodies for Kafka, Kinesis, object storage, Pub/Sub, Postgres, MySQL, and MongoDB, root fields, IAM role/workload identity and CA-only Kafka shapes, omission/empty-value behavior, sparse responses, API failures, invalid input, and OAuth rejection.

Validation:

• cargo fmt --all --check
• cargo clippy -p clickhousectl -- -D warnings
• cargo check -p clickhousectl --no-default-features
• cargo clippy -p clickhousectl --all-targets --no-default-features -- -D warnings
• cargo test -p clickhousectl — 1144 unit passed/1 ignored, 377 Cloud request-shape passed/1 ignored, and all local/telemetry binaries passed

Closes #569