Fix an issue which cause failure when updating a sub-CA

[gfxcc]

See b/382313978 for details

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

privateca: fixed an issue which causes error when updating labels for activated sub-CA

[github-actions]

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

@ScottSuarez, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 2 files changed, 64 insertions(+), 3 deletions(-))
google-beta provider: Diff ( 2 files changed, 64 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 40
Passed tests: 32
Skipped tests: 8
Affected tests: 0

Click here to see the affected service packages

• privateca

#### Non-exercised tests

🔴 Tests were added that are skipped in VCR:

• TestAccPrivatecaCertificateAuthority_subordinateCaCanUpdateLabel
  🟢 All tests passed!

View the build log

[ScottSuarez]

I'm worried about API state here.

We are explicitly removing certificateAuthority from the API request then it is possible API state will no longer retain subordinateConfig.certificateAuthority while the users config will. Resulting in a diff.

[gfxcc]

certificateAuthority was not be sent to API backend. It was only used to fetch pemIssuerChain which is the value specified when calling backend.
With that, certificateAuthority only stay locally.

[ScottSuarez]

API does retain this value
https://cloud.google.com/certificate-authority-service/docs/reference/rest/v1/projects.locations.caPools.certificateAuthorities#SubordinateConfig

and we do read it from the API. https://github.com/modular-magician/terraform-provider-google-beta/blob/8205ebe14bc69d903151fea9c192ddfb56c6b43a/google-beta/services/privateca/resource_privateca_certificate_authority.go#L1091

Just because the API isn't using the value doesn't mean it doesn't retain a state for it. This call will cause a diff between API state and users config.

[ScottSuarez]

I also left a comment on the bug. I am not sure why API is not respecting updateMask here