Serialize models with exclude_unset, not exclude_defaults

[negz]

Fixes #207

resource.update and resource.update_status serialized Pydantic models with model_dump(exclude_defaults=True), which asks "is this field different from its default?" and includes it if it is. The correct question for server-side apply is "did the caller set this field?", which exclude_unset answers.

exclude_defaults also regressed with newer datamodel-code-generator, which emits object defaults as a raw dict with validate_default=True instead of a default_factory. The default is validated into a model instance at construction, which doesn't compare equal to the declared dict default, so exclude_defaults fails to exclude it. Unset fields like spec.providerConfigRef then leaked into every composed resource.

exclude_unset is immune to how a default is represented (see crossplane/cli#64 (comment)). A field the caller didn't touch is absent from model_fields_set. It also keeps fields the caller explicitly set to their default value, which is more correct under server-side apply, where setting a field claims ownership of it.

The tests cover both datamodel-code-generator styles: the existing S3 Bucket model (old default_factory object defaults) and a new IAM AccountAlias model (newer validate_default=True object defaults). The AccountAlias case is the one that fails under exclude_defaults.

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change.

[negz]

I just pinned a fairly huge Python function project to use this commit and I'm not seeing anything concerning. As expected my tests need a few updates for cases where the function code explicitly set a field to its defaults. Before this change those fields would be omitted on serialization - now they're emitted.