Get the required-field policy for the scratch-template builder

Returns the tenant-aware required-field policy (mandatory attributes, identity one-of groups, and service-address co-requisite groups) for the given roster type. The builder uses it to mirror the server-side validation the create/update endpoints enforce.