feat(okta): add System Log, MFA, sessions, apps, roles, and group rules - #6741

The block covered user and group CRUD only, which left out the operations a
service desk and a SecOps team actually run. Adds 26 tools across the six
areas IT buyers ask for:

- System Log: query sign-ins and admin changes over a time window
- Factors: list, get, enroll, reset one, and reset all MFA factors
- Sessions: get, revoke one, and clear every session for a user
- Applications: list and get apps, and review or change user and group
  assignments
- Roles: list, assign, and revoke admin roles
- Group rules: list, get, create, activate, deactivate, and delete

Every endpoint and response shape was verified against the Okta Management
API reference. Three corrections the docs forced over the obvious guess: a
single factor is unenrolled with DELETE, not a lifecycle/reset that does not
exist; reset_factors takes no query parameters, so removeRecoveryEnrollment
belongs only to the single-factor DELETE; and group rule people conditions
carry exclude lists only, with no include counterpart.

Okta paginates with an opaque cursor advertised in the Link header rather
than a body field, which nothing here handled before. parseOktaPagination
reads it once and the list tools surface nextCursor and hasMore, so a caller
can page without reconstructing a URL. oktaHeaders and throwOktaError pull
the repeated SSWS auth and errorSummary unwrapping out of every new tool.

Both fields are free-text inputs coerced with Number(), so a stray
non-numeric entry became NaN and serialized to null, which Okta rejects
with a validation error pointing at the wrong field. Omit the field
instead so Okta applies its own default.

parseOktaPagination is the load-bearing piece of the pagination retrofit —
Okta advertises the opaque after cursor only in a Link header, never in the
body — so pin the next/self/absent/malformed cases along with the group-rule
mapper's exclude-only conditions and absent-nesting defaults.

…d inputs

The generic block handler merges the transform on top of the raw serialized
inputs (`{ ...inputs, ...transformedParams }`), so a key the transform omits
keeps the raw subBlock string rather than being dropped. Two intended
behaviors were silently defeated by that merge:

- a non-numeric `limit` or `priority` reached Okta verbatim instead of being
  dropped so Okta could apply its own default
- a blank profile field in `update_user` — a POST merge, so a partial update —
  overwrote the stored Okta value with an empty string instead of leaving it
  untouched

Assign every key the block can send, including the ones it drops, so
`undefined` actually removes them. Cover both cases with tests that assert on
the merge rather than on the transform alone.

Also align the block with what the tools really return: drop `targets` and
`debugData`, which only exist nested inside a System Log event and were never
emitted at the top level, and surface the fifteen user and group profile
fields `get_user` and `get_group` emit but the block did not declare.

Declare `authMode` explicitly rather than leaning on the docs generator's
credential-subBlock heuristic, route the remaining fifteen tools through the
shared `oktaHeaders`/`throwOktaError` helpers so there is one auth and error
path, add wand prompts for the search, filter, expression, and timestamp
fields, and add skills for MFA reset, sign-in investigation, and application
access review to match the operations this block now has.

`limit` on List Group Members is Okta's default of 1000, not a maximum.