SCIM: turning a domain's SCIM authority off takes effect at once (SCIM-60)

`allowScimProvisioning` is cached with the domain as DOMAIN_FLAG_SCIM, but
it wasn't among the fields whose change drops the cached entry, so flipping
the flag changed nothing until something else evicted the domain. SCIM-60
says the change takes effect without a restart.

Found by the two acceptance checks that were written but never called from
the driver, so neither had ever run: `authority` (SCIM-58 to SCIM-60,
through `synchronize_account` itself) and `rate_limits` (SCIM-14). Both are
wired in now, and `scim_tests` passes with them.

crates/common/src/cache/invalidate.rs

@@ -119,6 +119,10 @@ impl CacheInvalidationBuilder {
                     || (current.sub_addressing != new.sub_addressing)
                     || (current.allow_relaying != new.allow_relaying)
                     || (current.is_enabled != new.is_enabled)
+                    // inbuxa: SCIM-60, the flag is cached as DOMAIN_FLAG_SCIM,
+                    // so turning SCIM's authority on or off has to take effect
+                    // without a restart
+                    || (current.allow_scim_provisioning != new.allow_scim_provisioning)
                 {
                     self.invalidate(CacheInvalidation::Domain(id));
                 }