…dius-project#12563)

## Summary

A resource type schema can declare a `default` for a property, and
Radius never applied it. `schema.ApplyDefaults` fills absent properties
from the default declared in the schema, and a new `UpdateFilter` on the
dynamic resource PUT path runs it before the resource is saved.

Explicit values are never overwritten, and required properties are never
defaulted, so leaving one out still fails validation instead of being
quietly satisfied.

## Reason for change

Fixes radius-project#12532

Deploying a resource without setting an optional property puts a literal
template expression into the ARM request. The Azure recipe pack writes
parameters as expressions over the resource:

```
skuName: '{{context.resource.properties.size == "S" ? "Balanced_B0" : "Balanced_B1"}}'
```

Leave `size` unset and there's nothing to substitute, so the raw
`{{...}}` string is handed to ARM as the SKU name and rejected against
`allowedValues`.

The cause sits a level below the recipe. Validation checked a resource
against its schema without filling anything in, so every `default:` key
in every resource type has been inert — including the ones
`objectStorage`, `mongoDatabases`, `models`, `kafka` and `rabbitMQ`
already declare.

With the defaults from radius-project/resource-types-contrib#260
declared, the existing recipe expressions resolve on their own, and
neither the resolver nor the recipe pack needs to change. That covers
ten optional properties across the Azure pack, not just `size`:

| Type | Property | Unset today | With defaults |
| --- | --- | --- | --- |
| `redisCaches` | `size` | leaks | `Balanced_B0` |
| `postgreSqlDatabases` | `size` | leaks | `Standard_B1ms` / `Burstable`
|
| `mySqlDatabases` | `version` | leaks | `8.0.21` |
| `models` | `model` | leaks | `gpt-5-mini` |
| `mongoDatabases` | `database` | leaks | `mongo_db` |
| `mySqlDatabases` | `database` | leaks | `mysql_db` |
| `postgreSqlDatabases` | `database` | leaks | `postgres_db` |
| `rabbitMQ` | `queue` | leaks | `jobs` |
| `kafka` | `topic` | leaks | `events` |
| `objectStorage` | `containerName` | leaks | `data` |

Six of those defaults already existed, so half the fix is Radius finally
reading what contrib already wrote down.

Two things reviewers should know. The filter sits ahead of the
encryption filter, so a defaulted sensitive field is still encrypted.
And defaults are reapplied on every write rather than carried forward
from the previous version of the resource, which is what full-replace
PUT semantics ask for — the consequence is that changing a declared
default later changes what an existing resource gets on its next
deployment, so a default is part of a resource type's API contract.

## How to test

`go test ./pkg/schema/... ./pkg/dynamicrp/...` covers the new code
directly. `pkg/schema/defaults_test.go` asserts that explicit values
survive, required properties are never defaulted, read-only properties
are skipped, absent nested objects aren't created, and map and slice
defaults are deep copied so one resource can't mutate what the next one
sees.

End to end, all ten optional properties above were run through
`ApplyDefaults` and the parameter resolver against the real contrib
schemas and the real `recipepack/azure/aks-recipepack.bicep`
expressions. Every one emits a literal `{{...}}` without defaults and
resolves to the value in the table with them, on the unmodified resolver
and the unmodified recipe expressions.

`go vet` and `gofmt` are clean, and `pkg/schema/...`,
`pkg/dynamicrp/...`, `pkg/recipes/...`, `pkg/cli/manifest/...` and
`pkg/ucp/integrationtests/resourceproviders/...` all pass, including
after rebasing onto the kin-openapi 0.144.0 bump in radius-project#12561.

Built-in resource types pick this up once
radius-project/resource-types-contrib#260 merges and `make
update-resource-types` bumps the pin in `go.mod`, since the manifests
under `deploy/manifest/built-in-providers` are copies CI regenerates
from it.

## File change summary

| File | Summary of change |
| ---- | ----------------- |
| `pkg/schema/defaults.go` | New. `ApplyDefaults` walks a schema and
fills absent properties from their declared `default`, returning the
number applied. |
| `pkg/schema/defaults_test.go` | New. Covers explicit values, required
properties, read-only properties, nested objects, and deep copying of
map and slice defaults. |
| `pkg/dynamicrp/frontend/defaultsfilter.go` | New. `UpdateFilter` that
fetches the resource type schema and applies defaults before the
resource is saved, attaching the filled map only when something was
applied. |
| `pkg/dynamicrp/frontend/routes.go` | Register the defaults filter
ahead of the encryption filter. |

---------

Signed-off-by: Mike Azure <127820851+AzureMike@users.noreply.github.com>