Decouple delete permissions from resource paths

[shwetamurali]

Description

tfctl gates non-interactive DELETEs on a per-session permission keyed by resource class. Previously that class was inferred purely from the URL path, which broke for resources whose API path doesn't match their type name.
For an explorer saved query, the delete path is /organizations/{org}/explorer/views/{id}, so the class was inferred as
views. Granting --allow-delete=explorer-saved-queries never matched, and the delete was wrongly denied.

Changes:

1. New tfctl destroy command for typed resource deletion declares its resource class directly from the registry without needing path inference.
2. The delete gate now checks opts.ResourceType first, falling back toClassFromPath only for raw tfctl api -X DELETE.
3. ClassFromPath has explicit overrides for non-standard collection segments so raw API deletes authorize correctly too.

New resources whose API collection segment differs from their type name must be added to nonStandardPathClasses. The destroy command needs no change since it uses ResourceType directly.

Example Output

Authorized session (the case this PR fixes): grant is explorer-saved-queries while the path is .../views/..., and it now matches:

  $ tfctl harness exec --allow-delete=explorer-saved-queries --
      tfctl destroy explorer-saved-queries sq-abc -o my-org --dry-run
  WARNING: tfctl allows non-interactive deletes in this session for these types: explorer-saved-queries
  WARNING: deleting /api/v2/organizations/my-org/explorer/views/sq-abc (authorized by exec session)
  DRY RUN: would send DELETE request

DELETE https://.../api/v2/organizations/my-org/explorer/views/sq-abc

No active session permission refuses in non-interactive mode:

  $ tfctl destroy workspace ws-abc123 --dry-run
  ERROR: refusing to DELETE /api/v2/workspaces/ws-abc123 in non-interactive mode:
  no active session permission for resource class "workspaces".

  $ tfctl destroy explorer-saved-queries sq-abc -o my-org --dry-run
  ERROR: refusing to DELETE /api/v2/organizations/my-org/explorer/views/sq-abc
  in non-interactive mode: no active session permission for resource class
  "explorer-saved-queries".

PR Checklist

• Run npx changie new or install changie to prepare a new changelog entry for the next set of release notes.
• Ensure any command changes are sensitive to these global flags:
  • --json — Force machine readable output to stdout. Does not apply to stderr.
  • --markdown — Force markdown output to stdout. Does not apply to stderr.
  • --dry-run — Don't make any actual writes or other mutations. Describe what would have changed to stderr.
  • --quiet — Only render essential content.
• Get the logging interface from the context and add debug logging for interesting conditions and nonfatal situations.
• Run make gen/screenshot if the root command output changes.
• Add the Autocomplete field to positional arguments and flags to assist shell autocomplete.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.