[Rohan-sss1]

Summary

• Resolving a resource's tenant_ref (UUID → name, for the X-Avi-Tenant header) previously called GET api/tenant/ directly, which
  requires the Tenant-read RBAC permission — users without it got a 403 on every create/read/update/delete of a resource with a
  tenant_ref.
• The avi_tenant data source's by-name lookup had the same problem via GET api/tenant?name=, and silently swallowed the failure,
  letting a nonexistent/inaccessible tenant name resolve to an empty tenant_ref (objects landed in the default tenant instead of
  failing).
• Added getUserTenants() (avi/utils.go), which resolves tenants via GET api/user-tenant-list instead — this only requires being logged
  in, not Tenant-read, and returns exactly the tenants the calling user can access.
• getTenantNameFromRef() (UUID→name) and the new getTenantObjByName() (name→tenant object) both resolve through getUserTenants(),
  replacing the direct, permission-gated tenant API calls in APICreate, APIUpdate, APIRead, and APIDelete.
• APIRead's read-by-name branch now special-cases objType == "tenant" and returns the lookup error immediately instead of falling
  through to the generic "not found → clear id, continue" handling, so a nonexistent tenant name is now a hard plan-time error instead
  of a silent empty tenant_ref.

Test plan

• Verify terraform plan/apply succeeds creating a resource with tenant_ref under a non-superuser account that lacks Tenant-read
  permission (previously 403).
• Verify data "avi_tenant" "tenant" { name = "" } now fails plan with No object of type tenant with name is found, instead of silently succeeding.
• Verify no tenant_ref diff/drift on repeated plan runs for existing resources (no unintended format change).