[dknecht]

Description

cloudflare_zone_dnssec: write status = "active" when the v4 config has no status. An explicit status is left alone.

Motivation

Internal report BUGS-2130: after migrating, every plan shows

- status = "active" -> null

and the diff never goes away. Setting status = "active" by hand fixes it. In v4, status was computed-only and Create always enabled DNSSEC (UpdateZoneDNSSEC(... Status: active) unless already active/pending). In v5, status is Optional and not computed (internal/services/zone_dnssec/schema.go in the provider), so a config without it plans the API's "active" back to null on every refresh. That makes "active" the faithful translation of v4 behaviour.

The README described status being copied from state. That went away with the state pipeline in #241, so I've corrected it. It now also covers the edge case where DNSSEC was disabled outside Terraform: the first v5 plan shows "disabled" -> "active", and the user can set status = "disabled".

I left the status_to_null drift exemption alone. It also covers pending/disabled cases, which are out of scope here.

Type of change

• New resource transformer
• Fix to an existing transformer
• CLI / framework change
• Documentation
• Test / CI
• Refactoring (no behaviour change)

Testing

• Unit tests: go test ./internal/resources/zone_dnssec/, with updated expectations plus a new case that keeps an existing status
• Integration tests: TEST_RESOURCE=zone_dnssec go test ./integration/v4_to_v5 -run TestSingleResource, with the expected fixture updated
• E2E tests (if applicable)
• make lint-testdata passes

Checklist

• I have read CONTRIBUTING.md
• New resource transformers are registered in internal/registry/registry.go (n/a)
• Testdata resource names use the cftftest prefix (unchanged)
• Any # MIGRATION WARNING comments are documented in DIAGNOSTICS.md (n/a)