docs(readme): rewrite Workday connect section to reflect simplified install

[apurvabanka]

Summary

Rewrites the Workday (HCM / Payroll / Absence) section of
solutions/ess-maker-skills/README.md so it accurately describes how
/connect workday actually behaves today.

The previous copy documented Workday connect as a lightweight connector flow with
a "two supported install paths (simplified / legacy)" split, and listed legacy
ISU/RaaS provisioning (ISU accounts, security groups, domain permissions, OAuth
API client, WD_User_Context report) as things the kit sets up. That no longer
matches the implementation: /connect workday runs the simplified install and
the legacy ISU/RaaS path is in maintenance mode.

What changed

• Simplified-first framing — states the kit sets up the simplified install
  (single OAuthUser connection via Entra ID + Dataverse, no ISU accounts /
  security groups / RaaS reports; user context via Workday REST /workers/me).
• Legacy note — replaces the old "legacy path setup" bullets with a short
  maintenance-mode callout (existing legacy installs keep working; /connect workday targets the simplified path).
• Accurate step list — replaces the thin 2-bullet "what the kit sets up" list
  with the 6 steps /connect workday actually performs (Power Platform
  environment + DLP check, ESS base agent, Entra SSO, Workday tenant config,
  extension pack with end-to-end verification, optional first topic).
• Authentication — swaps the old auth-methods table for a single
  Entra ID Integrated (per-user On-Behalf-Of) description.
• Verify-first / resume-aware paragraph clarified.
• What you can build — adds a Manager-scenarios bullet.

Notes

• Docs-only change. No code, tests, or behavior affected.
• Content matches the product-approved copy for this section.
• Step 5 now explicitly calls out that Workday endpoints are allowlisted at the
  firewall, aligning the docs with the FlightCheck network-reachability step
  (WD-NET-001).

Testing

N/A — Markdown documentation only. Rendered/proofread locally; section flows
cleanly into the following Workday MCP Server subsection.