Add browser pool profile refresh policy

[IlyaasK]

Summary

• expose the durable refresh_on_profile_update browser-pool policy as an optional/computed Terraform attribute
• map explicit values through Kernel Go SDK v0.76 create and update parameters
• preserve Kernel's profile-dependent default when the value is omitted
• resend an explicit value when profile_id changes so false is not replaced by the API default
• flatten the API value into state and validate that true requires profile_id
• update generated resource docs and focused lifecycle coverage

Why

Kernel's API and Go SDK already support this durable browser-pool setting. Terraform should manage the same durable desired state as the CLI while keeping runtime pool operations outside the provider.

Intentionally unsupported

This does not add browser acquire/release/flush operations, leased-browser state, force deletion, profile mutation, or any other runtime/session behavior.

Verification

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• focused tests cover explicit false on create, enable/disable PATCHes, unchanged omission, profile-change defaults, validation, response flattening, malformed responses, and acceptance state assertions

The guarded live acceptance matrix passed on the top stacked branch: https://github.com/kernel/terraform-provider-kernel/actions/runs/30667323827. All seven jobs passed, including browser-pool create/read/update/import/delete and browser-pool data-source lookup.