feat: add default_org_member_roles to coderd_organization

[jscottmiller]

Adds support for managing an organization's default member roles (the default_org_member_roles setting added in coder/coder#25994, gated by the minimum-implicit-member experiment).

Changes

• coderd_organization resource: new optional default_org_member_roles set attribute.
  • Null leaves the facet unmanaged (same convention as coderd_user.roles), so deployments not using the feature see no drift.
  • [] is meaningful and clears the org's default roles (the Gateway Accounts use case).
  • Create issues a follow-up PATCH (the create API has no field for it); Update folds it into the existing UpdateOrganization PATCH via the SDK's *[]string pointer field, omitted when unmanaged.
• coderd_organization data source: new computed default_org_member_roles field; null when the deployment does not return the field.
• Example, regenerated docs, and acceptance test steps (set to two roles, then clear to []) in the experimental lane, with minimum-implicit-member added to that lane's CODER_EXPERIMENTS.

Failure modes

• Experiment disabled: the server's 403 message is surfaced as-is ("Changing default organization roles is not enabled on this deployment…").
• Older coderd: the PATCH silently ignores unknown fields, so the provider checks for the field's absence in the response and returns a clear "unsupported on this deployment" diagnostic (mirrors the workspace_sharing precedent). Experiment status is server state, so this is an apply-time failure by design.
• Invalid role names fail at apply with the server's 400 (the server accepts built-in role names only); no client-side name validation since the valid set is server-defined.

Testing

• make build, go vet, gofmt, make fmt, make gen (docs clean).
• golangci-lint reports only pre-existing usetesting findings, identical on main.
• Org acceptance tests require CODER_ENTERPRISE_LICENSE and were not run locally; they should run in the CI acceptance lane.

No dependency bump needed — the pinned codersdk already exposes Organization.DefaultOrgMemberRoles and UpdateOrganizationRequest.DefaultOrgMemberRoles.