fix(opcua): Part 9 condition children get instance-scoped NodeIds (#629)

Create(assignNodeIds: true) asked CustomNodeManager2.New, whose default returns the
node's current id, so every condition child kept the type's ns=0 instance-declaration id
(or an SDK-generated ns=0 number): translate of a child path returned BadNoMatch and a
Read of a browsed child id was BadNodeIdUnknown or served from the TYPE (UnshelveTime 0
on a condition timed-shelved for a minute), bypassing the data-plane ACL.

OtOpcUaNodeManager.New now derives {conditionId}/{browsePath} in the condition's
namespace, so the ACL scope of a child is its condition's scope plus the path. The
ShelvingState methods adopt their original AlarmConditionType_ShelvingState_* id as
MethodDeclarationId so clients calling them by that id still resolve. Condition removal
and rebuild forget the whole PredefinedNodes subtree so a removed condition's children
stop answering.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ServerEventRig.cs

@@ -74,10 +74,16 @@ internal sealed class ServerEventRig : IAsyncDisposable
     }
 
     /// <summary>Wires the authorizer over the given keys and grants, enforcing or not.</summary>
-    public DataPlaneAuthorityState Enforce(bool enabled, ApiKey[] keys, params NodeAcl[] grants)
+    public DataPlaneAuthorityState Enforce(bool enabled, ApiKey[] keys, params NodeAcl[] grants) =>
+        Enforce(enabled, keys, ScopePaths(), grants);
+
+    /// <summary>Wires the authorizer over the given keys, scope paths and grants, enforcing or not.</summary>
+    public DataPlaneAuthorityState Enforce(
+        bool enabled, ApiKey[] keys, IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> scopePaths,
+        params NodeAcl[] grants)
     {
         var state = new DataPlaneAuthorityState();
-        state.Apply(Cluster, "rev-1", keys, grants, ScopePaths());
+        state.Apply(Cluster, "rev-1", keys, grants, scopePaths);
         Nm.DataPlaneAuthority = state;
         Nm.Authorizer = new DataPlaneAuthorizer(
             state, new TriePermissionEvaluator(state.Tries), enabled, NullLogger.Instance, TimeProvider.System);