Flexible stage 2s in FAST resource manager

[ludoo]

This PR implements flexible stage 2s in the FAST resource manager stage, where stage 2 can now be arbitrarily defined via the fast_stage_2 variable or the associated factory.

Points of note:

• this allows defining several project factories, and should supersede Allow multiple stage-2 project factories #2834
• in principle, this change should also allow running stage 3 code as a stage 2, useful when environment segregation is not needed (e.g. a single GCVE stage)
• principal interpolation is now done using a single local that combines organization-level principals (groups) and stage service accounts
• internal stage service account names have been normalized to use -ro and rw instead of using -r for the read-only service account, so as to match what is used in the YAML files
• in principle (not tested yet) the project factory could be self-reliant and have its own folder created as a regular stage 2 without dependencies on top-level folders, but optionally leveraging them only when an additional folder is needed

Stage IAM is now explicit, instead of scattered across code files, and can be tweaked without code changes:

• each stage 2 IAM profile is defined via regular iam_ attributes for its own folder and the organization
• cross-stage permissions in stage 2s are now managed in two different ways:
  • conditional IAM grants scoped to the whole stage 2 are now explicitly defined in the YAML file/tfvar via iam_bindings, e.g. the delegated role grant for the project factories
  • stage 3 grants scoped to the environment (e.g. GCVE stages with iam delegation for dev or prod) are defined in the stage 2 via the stage3_config attribute, instead of in the stage 3 itself like before

Examples of the above IAM configurations from the factory file for the networking stage.

Folder config and folder-level IAM, which now follow our standard IAM interface and should be pretty intuitive:

Organization-level IAM, also following our standard interface:

Cross-stage IAM for other stage 2 (project factory delegated grant), now also explicit and tweakable:

Cross-stage IAM for stage 3:

TODO:

• check resource manager documentation for changes
• add stage 2 configuration snippets to stage 3s

[juliocc]

Awesome PR.

I'll start drafting something to document the schemas in a more human-friendly way. We should also document where interpolation happens