Applies a SCIM PATCH operation set (RFC 7644 §3.5.2) to the user.
Supports Add, Replace, and Remove operations against any
writable attribute in either schema.

Bonusly tolerates a few real-world IdP quirks:

• String boolean active — Microsoft Entra sends "True" /
  "False" strings instead of JSON booleans. We accept either
  (along with 1/0, yes/no, t/f — case-insensitive).
• Leading whitespace in URN paths — Entra occasionally emits
  " urn:..." on Add operations. We strip the leading space
  rather than rejecting the operation.

Activation / deactivation policy refusals (last admin, etc.)
surface as 422 so the IdP doesn't drift into thinking the
toggle stuck.