Removes the configured trust anchors, returning the provider to the JDK default trust store at login. This is the ONLY way to clear them: an update whose config omits trustAnchors PRESERVES the configured anchors, because the read side never returns them, so an edit form opens with the field empty and omitting it must not destroy the control. Clearing changes what the login plane trusts, so — exactly like any other trust-material edit — it returns the provider to DECLARED/disabled and a passing self-test is required before it can be enabled again. Idempotent: clearing a provider that has no anchors succeeds and changes nothing. This verb resolves the provider by id ALONE and therefore also reaches a TENANT-scope provider: trust anchors are a platform-plane control, so a tenant-scope row that acquired them out of band is refused by the tenant verbs and this is the only path that can remediate it. Required scope: admin.platform.idp.manage.