AWS Kafka (MSK): raise provider test coverage for the older update operations #1674

Follow-up from #1654 (#1517). Coverage of providers/aws/kafka is 84.9% from the provider tests alone (85.3% with the wire tests). The code added in #1654 is at 89–100%. Each item is a separate fix, and anyone is welcome to pick one up.

Low

• Add provider-level tests for the older update operations that today are only exercised through the wire tests: UpdateBrokerType, UpdateStorage, UpdateSecurity, RebootBroker and the other Update* calls. Target 90% package coverage.

How to work on an item

1. Claim it. Comment here with the item you're picking up, so two people don't fix the same thing. Small PRs are easier to review, so take one item, or a few that share a root cause.

2. Find out what real AWS does. Read the AWS API reference for the operation, and if you can, check the real CLI or SDK. Match the real error code, HTTP status and message. Don't guess them. Put the doc link in your PR.

3. Branch from development. All PRs go to development, never main.

4. Put the fix in the right layer. cloudemu has three layers, and the same behaviour has to work from the Go library and from cloudemu serve:

• services/<service>/driver/driver.go holds the driver interface. Touch it only when you add a new operation or field.
• providers/aws/<service>/ is the in-memory backend, and this is where most fixes belong: validation, state changes, lifecycle and error codes. Use memstore.Store, idgen for IDs, cerrors for errors and config.FakeClock for anything time-based.
• server/aws/<service>/ is the wire handler. It only translates the AWS protocol (query/XML, JSON or REST) to provider calls and maps errors back to the AWS shape. Don't put business rules here, or the library and the server will drift apart.
• If you add new state, make sure it survives cloudemu serve --persist and snapshots. persist/completeness_test.go will tell you if you missed something.
• If you add or change operations, run go generate ./... so docs/coverage stays current, and commit the result.

See docs/architecture.md and docs/STRUCTURE.md for the layout and file naming.

5. Test it the way a user would.

• A provider test that fails before your fix and passes after it.
• A wire test that drives the handler with the real aws-sdk-go-v2 client, like the existing *_sdk_test.go files.
• Run cloudemu serve and try the change with the AWS CLI (aws --endpoint-url http://127.0.0.1:4566 ...), including the error cases.
• If Terraform has a resource for it, run apply, then plan (it should show no changes), then destroy.

6. Run the checks before you push. go build ./..., go vet and go test on the packages you touched (the full go test ./... if you can), and golangci-lint run --timeout=9m ./... with zero issues.

7. Open the PR. Say which item it fixes, what changed and why, and how you checked it (paste the CLI commands you ran). Add "Part of #1674" so we can tick the box here once it's merged. See CONTRIBUTING.md for setup and code style.