feat(custom-domain): add multi-region PSC client module

[nandajavarma]

Description

Adds a separate multi-region custom-domain client module without changing the existing regional module or its Terraform resource addresses.

The module:

• accepts one or more PSC service attachments keyed by region
• creates one PSC NEG in the same region as each attachment
• attaches the regional NEGs to one global external HTTPS load balancer
• injects X-Gitpod-GCP-ID before requests reach the relay
• supports deploying us-central1 first and adding us-east4 when its producer attachment exists
• does not create a standalone PSC forwarding-rule endpoint or a VPN

A new module is intentional: converting the current regional resources to for_each and global resources would change existing Terraform addresses and force migration for current users.

Deployment prerequisites

This PR consumes regional service attachments; it does not publish them. Before adding a region, the producer must:

1. enable global access on that region's producer load balancer before creating its service attachment
2. publish an attachment in the same region as the consumer PSC NEG
3. configure the relay with every attachment URI

Multiple consumer NEGs provide full regional availability only when the producer also has independent relay capacity in each region.

Related PRs

• Relay URI validation: https://github.com/gitpod-io/gitpod-next/pull/29682
• Temporary producer global access: https://github.com/gitpod-io/gitpod-next/pull/29681
• Temporary single-endpoint consumer global access: feat(custom-domain): enable global PSC endpoint access #69

Part of CORE-8952.

Validation

• terraform fmt -check -recursive
• root terraform init -backend=false && terraform validate
• all example modules: terraform init -backend=false && terraform validate
• new module: terraform init -backend=false && terraform validate
• manual review against Google Cloud's PSC backend constraints: same-region NEG/attachment pairs, distinct backend regions, no PSC health checks

[nandajavarma]

Closing this PR because multi-region service attachments are producer-owned. The customer module should remain single-region and receive the attachment URI for the same region. The replacement Terraform work will live in gitpod-next/dev/gcp-psc-relay.