Implement various compliance configuration and principle of least privilege for hardened dataset

[vannicktrinquier]

This PR focuses on tightening security controls to align with the principle of Least Privilege for the various service account, and specifically targeting hardened datasets.

It also includes configuration updates to address findings (or false positives) from compliance standards like CIS GCP, CIS GKE, and NIST, ensuring the foundation can be ready for more sensitive organization (FSI)

Main changes:

• Restricted IAM permissions on hardened datasets to ensure only authorized service accounts and groups have access.
• Applied least privilege to prevent over-privileged access patterns in the data layer (by not using basic roles anymore)
• Update various configurations to satisfy NIST controls (storage lifecycle, log retention, firewall logs, vpc flow logs)
• Enforce Organization Policy compute.disableVpcInternalIpv6 as recommended by Compliance Manager
• Provide commented sample of configuration to enable VPC Flow Logs at subnet level, logging on firewall rules ...

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

[vannicktrinquier]

Update documentation which was incomplete previously.

Also mainly in this PR datasets/hardened/folders has been added with drift with classic datasets as follow mainly:

• classic still use owner and viewer role for *-rw and *-ro service account
• hardened now use predefined and custom roles.

Tests have been done extensively already to validate the permissions are the good ones:

• stage 0 to 3 tested (except 3-secops and 3-gcve-dev) but rest has been validate

[vannicktrinquier]

All the roles created below ar eneeded because generally predenefined roles does not provided permissions for *. getIamPolicy

This requires creation of multiple roles so readonly service account can retrieve iam policy when doing terraform plan in pipeline

[vannicktrinquier]

Use authoritative bindings for roles/owner, this to ensure:

• no roles owner permissions are provided
• but also, when a project is created, the creator principal is automatically being set as owner of the project. This ensure that once project is created, the owner role is removed to the creator

[vannicktrinquier]

Done in hardened datasets to follow NIST requirements where logs have to be made available at least for 90d.

[vannicktrinquier]

Compliance requirement to update storage class based on object activity

[vannicktrinquier]

For 2-networking and 2-project-factory, i have added commented line to ensure:

• logging enablement
• enforce owner role removed for project creator
• log retention
• vpc flow logs

Those have been commented only

[vannicktrinquier]

Was buggy when both var.data_defaults.billing_account and var.billing_account.id were empty