feat: invalidate DSPM and vulnerability scanning computed default role names when prefix/suffix are changed

[cs-wayne-hsieh]

Summary

• Invalidate DSPM and vulnerability scanning role name fields when resource_name_prefix or resource_name_suffix changes, so the API-computed default role names are refreshed
• Remove redundant writes to m.DSPM.RoleName and m.VulnerabilityScanning.RoleName in wrap() that were overwriting the sub-block state with the already-set top-level values

Test plan

• Verify that changing resource_name_prefix or resource_name_suffix triggers a plan diff for DSPM and vulnerability scanning role names
• Verify that DSPM and vulnerability scanning role names correctly reflect the prefix/suffix after apply
• Run existing acceptance tests for cloud_aws_account

Issue: CSPG-72361

[ffalor]

@cs-wayne-hsieh any eta on when we should merge this?

[cs-wayne-hsieh]

@ffalor Not yet, still waiting for response of some issues. Do you want me to convert it to draft for now?