fix: resolve workspace name before PATCH masking_rule

[adela-bytebase]

Summary

• workspaces/- does not resolve to the current workspace for policy endpoints — only the GetWorkspace RPC has dash-expansion logic (workspace_service.go:57)
• For policies, the resource string is passed through literally as an exact-match SQL filter (common/resource_name.go:658, store/policy.go:489)
• Existing workspace policies are stored with resource = 'workspaces/{real_id}' (migration 3.16/0001 backfills this)
• Without this fix, a PATCH with allowMissing=true silently creates a duplicate orphan policy (resource = 'workspaces/-') instead of updating the real one — the UI never sees it

Fetch the real workspace name via GET /v1/workspaces/- first, then use it in the masking_rule PATCH URL.

Follow-up to #96. Companion docs PR: bytebase/bytebase.com#1080

Test plan

• Run workflow 1 against a Bytebase instance with an existing global masking rule (created via UI) — confirm the PATCH updates the existing policy instead of creating a duplicate
• Run workflow 3 (classification) — same verification
• Verify in the Bytebase UI that only one global masking rule exists after the workflow run

🤖 Generated with Claude Code