repository_firewall on Composer proxy repositories: write doesn't survive a refresh

[madpah]

Describe the Issue or Bug

Discovered while building live acceptance-test coverage for repository_firewall against a real, connected Sonatype IQ Server (#285) - TestAccRepositoryGenericProxyFirewallToggle/COMPOSER.

Enabling repository_firewall on a sonatyperepo_repository_composer_proxy resource applies successfully (no error on apply), but a subsequent refresh (e.g. a second terraform plan, or terraform-plugin-testing's built-in post-apply refresh check) shows Terraform wanting to add repository_firewall again - i.e. NXRM's GET response for the Composer proxy repository does not reflect the firewall mode that was just written.

An initial fix was applied in internal/provider/model/repository_composer.go (MapMissingApiFieldsFromPlan), mirroring the existing pattern used for Raw (#461): mirror repository_firewall from the plan when it's missing from the API response. This resolved the immediate Provider produced inconsistent result after apply error on the apply itself, but the residual drift on refresh remains - meaning this may go deeper than a read-side gap like Raw's:

• It could be that NXRM's GET response for Composer proxy repositories genuinely never includes a firewall field (same class as Raw/[BUG]: Unable to update sonatyperepo_repository_*_proxy on nexus 3.94.0+ #461), in which case the existing mirror-from-plan approach is the right permanent fix and just needs to also apply consistently across refreshes, not just the immediate post-apply state.
• Or the PUT/update request for Composer might not actually be applying the firewall mode server-side at all (a write-side bug, not just a read-side gap), in which case mirroring from the plan is masking real drift rather than working around a known API limitation.

These need to be distinguished (e.g. by inspecting NXRM's actual stored repository configuration for a Composer proxy repo directly, independent of this provider) before landing a complete fix.

Repro

Against a real, connected Sonatype IQ Server (TF_ACC_IQ_SERVER=1) and NXRM 3.94+:

resource "sonatyperepo_repository_composer_proxy" "repo" {
  name   = "test-composer"
  online = true
  storage = {
    blob_store_name                 = "default"
    strict_content_type_validation  = true
  }
  proxy = {
    remote_url        = "https://packagist.org/"
    content_max_age   = 1440
    metadata_max_age  = 1440
  }
  negative_cache = {
    enabled      = true
    time_to_live = 1440
  }
  http_client = {
    blocked    = false
    auto_block = true
  }
  repository_firewall = {
    enabled    = true
    quarantine = true
  }
}

1. terraform apply - succeeds.
2. terraform plan again (or refresh) - shows a non-empty plan wanting to add repository_firewall back, meaning NXRM's GET no longer reports it.

Evidence

• Test: internal/provider/repository/repository_common_proxy_test.go - TestAccRepositoryGenericProxyFirewallToggle (Composer intentionally excluded from that table pending this fix, see the comment referencing this issue).
• Partial fix already applied: internal/provider/model/repository_composer.go.
• CI run where this was diagnosed: run 33074677281, job 98525877024 (branch ci/include-iq-server, PR ci: Introduce Sonatype IQ Server into Acceptance Test / HA Acc Test workflows #470).