fix: ga4gh_identify respects in_place=never for digest fields

[developer-rpai]

Bug

ga4gh_identify(allele, in_place="never") mutated the input object: it injected digest fields onto the Allele and its nested identifiable objects (e.g. SequenceLocation), even though the caller asked for no in-place edits. Reproducer from the issue: model_dump_json(exclude_none=True) grew from 323 to 411 chars after the call.

Closes #440

Root cause

The in_place="never" branch of get_or_create_ga4gh_identifier ran compute_ga4gh_identifier on the live object. That path always mutates: compute_digest() stores the digest on the object itself (store=True default), and ga4gh_serialize() calls _recurse_ga4gh_serialize, which calls get_or_create_digest() on every nested identifiable object, setting their digest fields in place. So both the top-level digest and nested digests were written into the caller's object.

Fix

When in_place is "never", compute the identifier on a copy.deepcopy of the object (src/ga4gh/vrs/models.py). The caller's object is left byte-identical; the only output is the returned identifier string. The default and always modes are unchanged.

Verification

• Reproduced the bug on pristine upstream main (object JSON grew 275 to 363 chars; allele.digest and allele.location.digest injected), then confirmed the fix leaves the object unchanged and returns the same identifier value.
• Added regression test test_identify_in_place_never_does_not_mutate (fails on pristine code, passes with the fix) and test_identify_in_place_modes_still_mutate (sanity check that default/always still set id).
• tests/test_vrs.py: all 13 tests pass. Doctests in src/ga4gh/core/identifiers.py and src/ga4gh/vrs/models.py: 3 pass.

Not verified

• Full test suite / CI: could not run here. tests/validation/test_models.py needs the submodules/vrs checkout (submodule fetch is blocked in this sandbox), and test_vrs_normalize.py / parts of test_dataproxy.py need the local seqrepo REST service on localhost:5000 (unavailable here; they fail with connection refused). Neither failure is related to this change.
• Ruff: not installed in this sandbox, but E501 is ignored in the repo config and the change follows existing style.

[jsstevenson]

I am not 100% on this fix; would really prefer to avoid an unnecessary deepcopy, but I'm not sure if that's avoidable