fix: scope LDAP domain terraform applies to LDAP resources

[MylesJP]

The LDAP add/update/remove-domain steps re-apply the entire OpenStack
Terraform plan. Since Terraform owns the charm config of every application in
the plan, any config set out-of-band with juju config (e.g. Traefik TLS
certificates) was reverted as drift whenever an LDAP domain was managed.

Pass -target flags for the three LDAP domain resources
(juju_application.ldap-apps, juju_integration.ldap-apps-to-logging,
juju_integration.ldap-to-keystone) so these steps only reconcile what they
own — the same pattern already used in steps/mysql.py, steps/hypervisor.py
and steps/vault.py. Targeted applies still destroy orphaned for_each
instances, so remove-domain continues to remove the keystone-ldap-<domain>
application.

Closes-bug: #2159042

QA steps

On a deployment with the LDAP feature enabled:

1. Set TLS config on traefik-public out-of-band (a self-signed cert is fine):

   openssl req -x509 -newkey rsa:2048 -nodes -days 30 \
     -keyout key.pem -out cert.pem -subj "/CN=cloud.test"
   juju config -m openstack traefik-public \
     tls-cert="$(cat cert.pem)" tls-key="$(cat key.pem)"
   

2. Run each LDAP domain operation (the LDAP server does not need to exist;
   keystone-ldap-k8s is a config-only charm):

   sunbeam ldap add-domain testdom --domain-config-file domain.yaml
   sunbeam ldap update-domain testdom --domain-config-file domain.yaml
   sunbeam ldap remove-domain testdom
   

3. After each operation, verify the TLS config survived (without this fix,
   add-domain clears it):

   juju config -m openstack traefik-public tls-cert
   

4. Verify remove-domain still deletes the domain application:

   juju status -m openstack | grep keystone-ldap   # expect no output
   

Verified end-to-end on a single-node 2024.1 deployment (repro on stock rev
1060, fix confirmed with a patched snap); transcript and logs attached to the
LP bug.

Links

• Bug: https://bugs.launchpad.net/snap-openstack/+bug/2159042

Jira card: OPEN-4637

[MylesJP]

Will propose backport to 2024.1/stable

[ahmad-can]

LGTM