Add iam_by_principals_additive to project, organization and folder modules

[juliocc]

This pull request introduces the iam_by_principals_additive variable to the folder module, addressing the feature request outlined in #2805.

This implementation merges the functionality of iam_by_principals_additive with the existing iam_bindings_additive logic, utilizing a single google_folder_iam_member resource. While the core implementation is straightforward, the validation logic requires further review and likely expansion. Currently, validation only prevents the same principal/role combination from being defined in both iam_bindings_additive and iam_by_principals_additive.

Open questions:

• should we maintain a single google_folder_iam_member resource for all additive bindings, or would a separate dedicated block for iam_by_principals_additive be preferable?
• what other validations, if any, are necessary to ensure correct usage.
• I'm chose iam_by_principals_additive to be consistent with the existing iam_bindings_additive naming.

Usage would be something like this:

module "folder" {
  source              = "./fabric/modules/folder"
  parent              = var.folder_id
  name                = "folder"

  iam_by_principals_additive = {
    "user:[email protected]" = [
      "roles/logging.admin",
      "roles/logging.viewer"
    ]
  }
}

And this should fail:

module "folder" {
  source              = "./fabric/modules/folder"
  parent              = var.folder_id
  name                = "folder"

  iam_bindings_additive = {
    "my-binding" = {
      role   = "roles/logging.admin"
      member = "user:[email protected]"
    }
  }

  iam_by_principals_additive = {
    "user:[email protected]" = [
      "roles/logging.admin",
      "roles/logging.viewer"
    ]
  }
}

Thoughts?

[ludoo]

I like this, the implementation is simple and readable.

I'm just slightly concerned about the additional additive surface this introduces, which IMHO will just make it easier to create unintentional overlaps between authoritative and additive. But that's kind of inevitable and the new interface might actually be useful, so...

As for how many resources, my preference would be for a single one but I don't think it makes a lot of difference TBH, both should work.

[wiktorn]

• what other validations, if any, are necessary to ensure correct usage.

If any, I'd add a check, if there is any overlap in roles between authoritative roles and additive ones, though in my experience, this was usually caused by IAM grants managed by separate modules.