feat: add networkACLKeys handler for HMAC signature key management

[ankita10119]

🔧 Changes

Adds support for managing Network ACL HMAC signing keys (/api/v2/keys/network-acls) as a new networkACLKeys resource type.

New handler (networkACLKeys)

• Supports create and delete, keys are immutable after creation so detected updates are treated as no-ops
• Runs at @order(60), before networkACLs (@order(65)), ensuring keys exist before ACL rules that reference them
• value (raw key material) is write-only and never returned by the API, it is not exported and is optional in config; supply at deploy time via keyword replacement (e.g. ##HMAC_KEY_VALUE##), if absent, creation is skipped with a warning rather than failing
• Delete path uses (client.keys.networkAcls as any).delete(id) pending delete() being added to NetworkAclsClient in node-auth0
• 409 on delete (key still referenced by an ACL rule) surfaces a descriptive error

Updated networkACLs handler

• Adds http_message_signature to MatchSchema so ACL rules can reference HMAC keys by id
• http_message_signature is not yet present on NetworkAclMatch in node-auth0 6.3.0, the schema change works at runtime today and the TODO comment will be removed in the next SDK release

Supporting changes

• YAML and directory context handlers for networkACLKeys (strips value, created_at, updated_at on export; keeps id and fingerprint for reference)
• NETWORK_ACL_KEYS_DIRECTORY: 'network-acl-keys' constant
• networkACLKeys added to Assets, AssetTypes, and all handler index files

📚 References

🔬 Testing

Unit tests: All 1449 existing tests pass. The mockMgmtClient in test/utils.js was extended with keys.networkAcls.list to cover the new handler path.

E2E tests (lockdown mode): GET /api/v2/keys/network-acls nock entries added to all four relevant recordings. The handler is exercised in every E2E deploy/dump flow (Retrieving networkACLKeys data from Auth0 visible in logs). 4 pre-existing failures unrelated to this change (Deploy CLI client PATCH mismatch present on master before this PR).

Manual test against real tenant:

• Tenant confirmed tenant_acl_hmac_signature + tenant_acl_management_api flags active
• a0deploy import - created key, confirmed present via GET /api/v2/keys/network-acls with correct fingerprint
• a0deploy export - wrote name, alg, fingerprint only (value correctly stripped)
• Re-import - pure no-op (idempotent, key matched by name)

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 29.00000% with 71 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.16%. Comparing base (4955e4b) to head (5c3a476).

Files with missing lines	Patch %	Lines
src/tools/auth0/handlers/networkACLKeys.ts	20.40%	38 Missing and 1 partial ⚠️
src/context/directory/handlers/networkACLKeys.ts	27.58%	20 Missing and 1 partial ⚠️
src/context/yaml/handlers/networkACLKeys.ts	38.88%	8 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1480      +/-   ##
==========================================
- Coverage   80.81%   80.16%   -0.66%     
==========================================
  Files         163      166       +3     
  Lines        7805     7905     +100     
  Branches     1741     1761      +20     
==========================================
+ Hits         6308     6337      +29     
- Misses        797      863      +66     
- Partials      700      705       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.