Type Alias ManagedSystemObjectSchemaOps

Read-only counterpart to ManagedObjectSchemaOps.ts, for managed system object types (svcacct, teammember) instead of regular/custom managed object types. Split out from ManagedSystemObjectOps.ts the same way ManagedObjectSchemaOps.ts was split from ManagedObjectOps.ts, to keep every managed-system-object capability under the same admin-only risk posture (see CapabilityMetadata.ts's idm.managedSystem.* entries, all explicitly riskClass: 'critical').

There is deliberately no write capability here yet. Regular managed objects have a confirmed, documented per-property mutation path (IDM's dedicated v2 relationship-schema API — see ManagedObjectSchemaOps.ts's header comment), but svcacct/teammember are fixed, Ping-defined system types; whether that same v2 API accepts a managed-system-object type at all has not been verified against a live tenant. Add updateManagedSystemObjectSchemaProperty / removeManagedSystemObjectSchemaProperty here only after confirming that live, not by assuming symmetry with the regular-object case.