Add AI Gateway securables to databricks_grant/databricks_grants

[khakhlyuk]

The databricks_ai_gateway_model_service, _mcp_service, and _model_provider_service resources shipped in v1.124.0 (auto-generated via the plugin framework), but their UC permissions could not be managed in Terraform because the grants resources' SecurableMapping was never extended.

Add model_service, mcp_service, and model_provider_service to permissions.Mappings, which generically exposes them as fields on both databricks_grant and databricks_grants (schema fields, ID parsing, and AtLeastOneOf are all driven off the map). Privileges pass through unchanged, so EXECUTE / MANAGE / ALL_PRIVILEGES work immediately.

Securable-type strings verified against the Grants API. Update the no-securable error fixture for the three new fields and document the new securables in the grant/grants resource docs.

Changes

Tests

• make test run locally
• relevant change in docs/ folder
• covered with integration tests in internal/acceptance
• using Go SDK
• using TF Plugin Framework
• has entry in NEXT_CHANGELOG.md file

[github-actions]

Unit tests

If this PR is from a fork, the tests check runs offline against a pre-warmed Go module cache because fork PRs cannot authenticate to the internal Go module proxy.

If this PR changes go.mod or go.sum, the tests check will fail until a maintainer warms the cache for it:

Actions -> Warm Go Cache -> Run workflow -> pr_number = 5941

Re-run the failed check once the cache warming completes.

Integration tests

Integration tests don't run automatically for external contributors; an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/terraform

Inputs:

• PR number: 5941
• Commit SHA: ec960dc148968528cca270eec9fba7bf0d1f79ce

Checks will be approved automatically on success.