added svpc subnet controls for project factory

[lnesteroff]

Adding option in project factory to define subnet level IAM for shared vpc.

---

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

[ludoo]

we should add subnets to factories_config.contexts so we can try a substitution here

[lnesteroff]

Do you mean something along these lines:

factories_config = {
  context = {
    network_subnet_users = {
      default = {
        "region/subnet" = ["gcp-devops"]
      }
    }
  }
}

So that project factories could attach a user/group to a default subnet? If the expectation is that that group/user should always have access to that subnet, it would only need to be applied once.

I also just added a service_subnet_iam_grants, which is similar to service_iam_grants and does the permissions based on modules/projects/sharedvpc-agent-iam.yaml, but applied the networkUser roles at the subnet level. I think that might make sense to have as a default, so if an org wants to allow compute.googleapis.com to be enabled on a default subnet on all projects it would add the agent.

[lnesteroff]

I think I misunderstood what we were doing with contexts. I've added a "subnets" context that we can use for substitutions.