[Fix] Suppress options.pem_private_key_expiration_epoch_sec attribute for databricks_connection (#4474)

Suppress `options.pem_private_key_expiration_epoch_sec` attribute from
API to prevent drift when creating a Snowflake connection using
`pem_private_key`.

Resolves #4471 

## Changes
Add `suppressPemPrivateKeyExpiration` function. When
`options.pem_private_key_expiration_epoch_sec` exists, we suppress for
`options.pem_private_key_expiration_epoch_sec`.

## Tests
Tested in my local environment.

First run:
```
> terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are
indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # databricks_connection.this will be created
  + resource "databricks_connection" "this" {
      + connection_type = "SNOWFLAKE"
      + id              = (known after apply)
      + metastore_id    = (known after apply)
      + name            = "<REDACTED>"
      + options         = (sensitive value)
      + owner           = (known after apply)
      + read_only       = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

databricks_connection.this: Creating...
databricks_connection.this: Creation complete after 1s [id=<REDACTED>|<REDACTED>]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
```

Subsequent run:
```
> terraform apply

databricks_connection.this: Refreshing state... [id=<REDACTED>|<REDACTED>]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so
no changes are needed.

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
```

Changing another variable within `options` inside Terraform code:
```
> terraform apply

databricks_connection.this: Refreshing state... [id=<REDACTED>|<REDACTED>]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # databricks_connection.this will be updated in-place
  ~ resource "databricks_connection" "this" {
        id              = "<REDACTED>|<REDACTED>"
        name            = "<REDACTED>"
      ~ options         = (sensitive value)
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

databricks_connection.this: Modifying... [id=<REDACTED>|<REDACTED>]
databricks_connection.this: Modifications complete after 1s [id=<REDACTED>|<REDACTED>]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
```

- [x] `make test` run locally
- [ ] relevant change in `docs/` folder
- [ ] covered with integration tests in `internal/acceptance`
- [ ] using Go SDK
- [ ] using TF Plugin Framework

Author: 840

NEXT_CHANGELOG.md

@@ -10,6 +10,8 @@
 ### Bug Fixes
  * Fixed an issue where reordering objects in a (pluginfw) Share wouldn’t update properly unless other changes were made ([#4481](https://github.com/databricks/terraform-provider-databricks/pull/4481)).
 
+ * Suppress `options.pem_private_key_expiration_epoch_sec` attribute for databricks_connection ([#4474](https://github.com/databricks/terraform-provider-databricks/pull/4474)).
+
 ### Documentation
 
  * Add an example for Databricks Apps permissions ([#4475](https://github.com/databricks/terraform-provider-databricks/pull/4475)).

catalog/resource_connection.go

@@ -2,6 +2,7 @@ package catalog
 
 import (
 	"context"
+	"log"
 
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/terraform-provider-databricks/common"
@@ -34,12 +35,21 @@ type ConnectionInfo struct {
 	ReadOnly bool `json:"read_only,omitempty" tf:"force_new,computed"`
 }
 
-var sensitiveOptions = []string{"user", "password", "personalAccessToken", "access_token", "client_secret", "OAuthPvtKey", "GoogleServiceAccountKeyJson"}
+var sensitiveOptions = []string{"user", "password", "personalAccessToken", "access_token", "client_secret", "pem_private_key", "OAuthPvtKey", "GoogleServiceAccountKeyJson"}
+
+func suppressPemPrivateKeyExpiration(k, old, new string, d *schema.ResourceData) bool {
+	if k == "options.pem_private_key_expiration_epoch_sec" {
+		log.Printf("[INFO] Suppressing diff on %s", k)
+		return true
+	}
+	return false
+}
 
 func ResourceConnection() common.Resource {
 	s := common.StructToSchema(ConnectionInfo{},
 		func(m map[string]*schema.Schema) map[string]*schema.Schema {
 			m["name"].DiffSuppressFunc = common.EqualFoldDiffSuppress
+			m["options"].DiffSuppressFunc = suppressPemPrivateKeyExpiration
 			return m
 		})
 	pi := common.NewPairID("metastore_id", "name").Schema(
@@ -132,6 +142,7 @@ func ResourceConnection() common.Resource {
 			}
 
 			updateConnectionRequest.Owner = ""
+			delete(updateConnectionRequest.Options, "pem_private_key_expiration_epoch_sec")
 			_, err = w.Connections.Update(ctx, updateConnectionRequest)
 			if err != nil {
 				if d.HasChange("owner") {