Add OU/Project import support to importer script + fix api_call 401 retry

[bshutterkion]

Summary

Adds the ability to import Kion OUs and Projects themselves (as kion_ou / kion_project resources) to the importer script, and fixes a retry bug in api_call that could cause resources to import as empty.

Previously the importer only imported the Cloud Access Roles attached to OUs/Projects, not the OUs/Projects as manageable Terraform resources.

Changes

• import_ous.py (new) — imports OUs as kion_ou resources. The root OU (no valid parent) is skipped. OUs with locally-assigned owners import cleanly and validate against the provider schema.
• import_projects.py (new) — imports Projects as kion_project resources (best-effort, see limitations below).
• --skip-ous / --skip-projects flags added; wired into main().
• api_call 401-retry fix — on a 401 the retry result was never returned, so the function fell through to return False even when the retry succeeded. Callers then saw False and reported empty results (e.g. "0 roles"/"0 projects") on any endpoint that hit a transient 401. The retry now returns its result, forwarding the original method/payload/headers.
• templates.py — corrected the generated provider.tf version pin from the non-existent 0.13.12 to the current published 0.3.34, which unblocks terraform init on generated output.
• README — documents the new flags and the project import caveats.

Known limitations (documented in README)

These stem from the Kion API not returning fields that the kion_ou / kion_project resources require on read — not from the importer:

• Projects: permission_scheme_id is not returned by any API endpoint, so a placeholder is written with a # TODO. Owners are inferred from the project's permission mapping (Admin app role) where present; otherwise a # TODO is written. Budgets/funding are not imported.
• OUs: the OU detail endpoint returns only locally-assigned owners, not inherited ones. OUs that inherit owners from a parent come back ownerless and are flagged with a # TODO (the resource requires at least one owner).

In both cases the importer flags the gap rather than fabricating values, so generated files for affected resources will not plan cleanly until the TODOs are resolved.

Testing

• Ran both importers end-to-end against a live Kion environment: no errors; all generated files are syntactically valid HCL (terraform fmt).
• terraform init + terraform validate against the real provider schema: OUs with local owners validate 100% clean; the only validation errors are the documented owner-requirement gaps.
• Confirmed the retry fix leaves the normal (200) path unchanged.