nd_manage_vpc_pair: Add resource deploy scope and make config_actions.deploy opt-in

[sivakasi-cisco]

Summary

Adds a new resource deploy scope to nd_manage_vpc_pair's config_actions,
and makes deploy opt-in (deploy: false by default) so the module never pushes
configuration to the fabric unless explicitly requested.

What changed

New config_actions.type: resource scope

• Adds resource as a third choice for config_actions.type (alongside
  switch and global).
• resource deploys only the peer switches that make up the managed vPC pair(s)
  and are left out-of-sync — not every out-of-sync switch in the fabric
  (switch), nor the entire fabric (global).
• Nexus Dashboard has no vPC-pair-level deploy primitive, so a vPC pair resource
  is mapped to its two peer switches (switch_id / peer_switch_id), which are
  already resolved to serial numbers upstream.
• Peers not found in fabric inventory (mistyped serial, wrong fabric) raise a
  module.warn instead of being silently skipped, so a resource deploy never
  becomes a silent no-op. An already in-sync pair is a clean no-op.

deploy now defaults to false (opt-in)

• config_actions.deploy defaults to false everywhere: the pydantic
  ConfigActionsModel, the Ansible argument_spec, get_config_actions()
  (explicit read + fallback), custom_vpc_deploy(), and module DOCUMENTATION.
• save still defaults to true. Set deploy: true explicitly to push
  configuration to the fabric.
• Prevents unintended fabric deploys from a bare config_actions: block.

Files

• plugins/module_utils/manage_vpc_pair/common.py — resource added to
  choices; deploy fallback → false.
• plugins/module_utils/manage_vpc_pair/deploy.py — resource-scoped deploy
  (_pair_identifiers, _get_managed_pair_switches_needing_deploy);
  switch/resource share the per-switch deploy path.
• plugins/module_utils/models/manage_vpc_pair/vpc_pair_model.py — model +
  argument_spec: deploy default false, type Literal gains resource.
• plugins/modules/nd_manage_vpc_pair.py — DOCUMENTATION: resource
  choice/description, deploy default false.
• tests/unit/module_utils/test_manage_vpc_pair_deploy.py,
  test_manage_vpc_pair_model.py — unit coverage for resource scope + defaults.

Behavior / compatibility

config_actions is introduced in this PR, so defaulting deploy to false
sets the initial contract rather than changing released behavior. Playbooks must
set config_actions.deploy: true to trigger a deploy.

Testing

• Unit: test_manage_vpc_pair_deploy.py / test_manage_vpc_pair_model.py
  (resource-scope deploy, in-sync no-op, unresolved-peer warning, model &
  argument_spec defaults).
• Live integration: nd_vpc_pair target (merge/replace/override/delete/gather)
  against a lab fabric.

Closes #428