fix: guard against a None action in ZPA isolation rule updates

[hackerboey]

Fixes #574

PolicySetControllerAPI.update_isolation_rule and update_isolation_rule_v2 both declare
action: str = None, but build the payload with an unguarded action.upper(). A partial
update that does not pass action therefore raises

AttributeError: 'NoneType' object has no attribute 'upper'

before any request is built, so those methods cannot be used for a partial update at all.

Why this shape of fix

The same file already guards the identical expression elsewhere, e.g.

"action": action.upper() if action else None
"action": action.upper() if action else kwargs.get("action", "").upper()

so this looks like an internal inconsistency rather than a deliberate difference. The change
makes the two unguarded sites match the guarded form already used nearby — no new pattern is
introduced, and behaviour for a caller who does pass action is unchanged.

Test

Adds tests/unit/test_zpa_policies.py, following the layout and style of the existing flat
tests/unit/test_*.py files. It mocks the request executor, so no credentials or network access
are needed — the failure occurs while building the payload.

Verified against this branch: 2 passed. Verified against master's policies.py: 2 failed
with the AttributeError above, so it is a genuine regression guard rather than a tautology.
Full tests/unit: 601 passed. ruff check, ruff check --select I and
black --check --line-length 127 are all clean.

Diff is +52/-2 across two files, and the change to policies.py is two lines. Happy to rescope
if you would prefer a different guard form, or to extend it to other optional fields.