Issue #3630154: Saving a user wipes the Keycloak user's required actions

An update sent update_required_actions as the account's complete list; with none configured, Keycloak removed every required action (UPDATE_PASSWORD from the creation, actions an administrator set). Now the configured actions are added to the account's own (from the lookup, or read from the account when the lookup lacks them); with none configured, requiredActions is left out of the request and Keycloak keeps the list. Same pattern as #3624171 for the attributes. The second commit adds three unit tests (all fail without the fix).

Closes #3630154