feat(gcp-runner): manage IAM for pre-created accounts

[nandajavarma]

Description

Adds an optional attach_iam_policies field to pre_created_service_accounts.

The field defaults to false, preserving existing behavior for deployments that manage IAM outside the module. When set to true, the module creates the runner and proxy custom roles and attaches the required project-level and per-service-account roles/iam.serviceAccountUser grants while continuing to use, rather than create, the supplied service accounts.

Deprecated build_cache, secret_manager, and pubsub_processor fields remain accepted for backward compatibility. Resource-scoped access to infrastructure created by the module is unchanged.

Compatibility

• Omitting attach_iam_policies preserves the current plan behavior.
• Setting it to false preserves external IAM management.
• Setting it to true requires the Terraform deployer to create custom roles and update IAM policies.
• Existing pre-created service accounts are never created or replaced by this option.

Issues

Fixes CORE-8958

How to test

• terraform fmt -check -recursive
• terraform validate
• Evaluated a pre-created runner account with the default field and confirmed IAM management resolves to false.
• Evaluated the same account with attach_iam_policies = true and confirmed IAM management and custom-role creation resolve to true.

Documentation

The module IAM guide is updated in this PR.

Public Ona documentation: https://github.com/gitpod-io/gitpod-next/pull/28178