Apply only checks that the server supports dry-run in the create path,
not the update path, which is pretty bad.