fix(server): stop imposing one instance's status workflow

[mimi1vx]

Two self-contained commits, each verified independently (builds/tests/lints
clean on its own).

What

update_bug_status and mark_as_duplicate hard-coded one Bugzilla
instance's status workflow, and bug_fields discarded exactly the data
that would let a client discover it instead of guessing.

• fix(server): stop imposing one instance's status workflow —
  update_bug_status dropped a local CLOSED-requires-resolution
  pre-check (it missed RESOLVED and every custom closed status, and
  fired on instances where CLOSED isn't even the closing status) along
  with a synthesised "resolution": "" on every non-CLOSED/VERIFIED
  target — verified against Bugzilla::Bug::set_bug_status, that empty
  string makes a stock RESOLVED transition fail with
  missing_resolution, an upstream error the tool was causing, not
  avoiding. The payload now sends status always and resolution only
  when the caller gives a non-empty one; Bugzilla enforces the
  resolution requirement itself and clears it automatically on reopen.
  mark_as_duplicate similarly stopped forcing status = CLOSED —
  set_dup_id already applies the instance's own
  duplicate_or_move_bug_status (plus resolution DUPLICATE) from
  dupe_of alone.
• feat(server): report the status workflow in bug_fields —
  bug_fields's detail projection reduced legal values to bare names,
  dropping is_open and can_change_to, the exact fields Bugzilla
  attaches to bug_status for this purpose. Each legal value now
  projects to {name} plus is_open/can_change_to (itself
  [{name, comment_required}]) when the upstream value carries them;
  absent keys are omitted, never null, so every other field's values
  stay exactly as cheap as before.

Behavior change

On a stock Bugzilla instance, mark_as_duplicate now leaves a bug in
RESOLVED/DUPLICATE rather than always CLOSED/DUPLICATE, because the
operator's duplicate_or_move_bug_status decides, not this server.
Anyone with a runbook expecting CLOSED/DUPLICATE needs to update it.

Invariants touched

• I11 — unaffected; the capability checks on bug_id/duplicate_of
  are untouched, only the resulting write payload changed.
• I15 — unaffected; every routed tool still has an
  audit_refusal_text entry and writes exactly one audit record per
  call (existing tests unmodified).
• I16 — unaffected; bug_fields's workflow data is still reported
  exactly as Bugzilla gave it, never filtered against the guard policy.

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo clippy -p bugwarden --features gen --all-targets --locked -- -D warnings
• cargo test --workspace --all-targets --locked — all green, including:
  • crates/bugwarden/tests/tools_wiremock.rs: update_bug_status
    without a resolution PUTs exactly {"status": ...} (no synthesised
    resolution); with a resolution PUTs both; targeting CLOSED
    without one now reaches upstream instead of being refused locally;
    mark_as_duplicate PUTs exactly dupe_of + comment; the bug_fields
    detail test extended to assert is_open/can_change_to survive the
    projection for bug_status while a plain field (priority) still
    projects to {name}-only.
• cargo deny check — clean (no new dependencies).
• Each commit verified standalone in an isolated worktree (fmt, clippy,
  test, deny) — both build and pass on their own, not just as a pair.