feat: Add access rule CRD to appcred provider

[mashawes]

Extends the application credential provider with access rule CRD (create, read, delete, no update), following the same layering as application credentials.

• Adds two error variants in core-types, AccessRuleNotFound and AccessRuleInUse. The AccessRule and AccessRuleCreate types already existed, so no new domain types were needed.
• Adds create, get, list, and delete to the appcred-sql driver under application_credential/access_rule/. Access rules are user-scoped, and the user-facing id maps to the external_id column. Delete refuses to remove a rule that is still attached to an application credential (AccessRuleInUse) rather than cascade-deleting it, since that would silently strip a live credential's restriction; this matches Python Keystone's behavior.
• Wires the new methods through the ApplicationCredentialApi provider including backend, provider_api, service, mock, and mod. The provider validates the request and generates the rule id when none is supplied, so the driver only has to persist the final value.
• Adds integration tests under tests/integration/src/application_credential/access_rule.rs covering the full create, get, list, and delete cycle, plus the not-found and in-use error cases.

Closes #776

Note: this contribution was developed with AI assistance.

[gtema]

please sort methods in all traits and impls that you modify alphabetically sorted. Otherwise looks fine

[gtema]

https://github.com/openstack-experimental/keystone/blob/main/crates/identity-driver-sql/src/local_user/create.rs#L44, https://github.com/openstack-experimental/keystone/blob/main/crates/identity-driver-sql/src/password/set.rs#L44 show that in some cases we need to invoke backend functions in the transaction context. For access rules it is definitely the case where create/delete operations would be bound to the parenting application_credential create/delete. This is a small interface change that will not even require unittest changes. Otherwise fine

[gtema]

one, hopefully final thing. Please add "user_id" into the AccessRule core-types and correspondingly expose it from the database. It would be populated during creation and is definitely necessary in output. The AccessRule struct already contain a comment that in the DB user_id must be made not optional, but we can't do this in the keystone-rs project

[gtema]

we should extend the AccessRuleCreate to have user_id: String