SCIM: turning a domain's SCIM authority off takes effect at once (SCIM-60)

`allowScimProvisioning` is cached with the domain as DOMAIN_FLAG_SCIM, but
it wasn't among the fields whose change drops the cached entry, so flipping
the flag changed nothing until something else evicted the domain. SCIM-60
says the change takes effect without a restart.

Found by the two acceptance checks that were written but never called from
the driver, so neither had ever run: `authority` (SCIM-58 to SCIM-60,
through `synchronize_account` itself) and `rate_limits` (SCIM-14). Both are
wired in now, and `scim_tests` passes with them.

tests/src/scim/acceptance.rs

@@ -65,6 +65,8 @@ pub async fn test(test: &TestServer, scim: &ScimTest) {
     deletion(test, scim).await;
     adoption(test, scim).await;
     tenants(test, scim).await;
+    authority(test, scim, closed_id).await;
+    rate_limits(test, scim).await;
 
     admin
         .registry_destroy(ObjectType::Domain, [closed_id])