KAFKA-20921: Make SCRAM metadata deeply immutable

[Gimini-3]

This change makes SCRAM metadata images deeply immutable.

ScramImage previously wrapped only the outer mechanisms map without copying it, leaving constructor aliases and nested credential maps mutable. ScramCredentialData also retained and exposed its byte[] components through constructors, accessors, and conversion methods.

The change:

• snapshot-copies and wraps the outer and nested mechanism maps;
• defensively copies SCRAM credential arrays at construction and export boundaries;
• adds regression tests covering constructor inputs, accessors, nested maps, toRecord(), and toCredential().

Related work: KAFKA-19305 mentioned ScramImage immutability, but PR #19847 only updated ClientQuotaImage and TopicImage.

Validation:

• ./gradlew :metadata:spotlessCheck
• ./gradlew :metadata:test

This contribution is my original work and I license it to the project under the project's open source license.