Add managed BYOC bootstrap and app-root outputs for GCP

[Alexey Soldatchenko (soldatchenko)]

Adds the GCP bootstrap helpers and Terraform outputs needed for Braintrust-managed BYOC deployments. This is intended to make GCP BYOC setup easier to review, automate, and operate with a separate infrastructure and application deployment flow. This change is backward compatible for existing module consumers. It adds new outputs and helper files, and marks existing secret outputs as sensitive. It does not remove or rename existing inputs or resources.

• Adds managed-byoc bootstrap helpers for required APIs, deployment/support service accounts, IAM grants, and quota review
• Adds outputs needed by the separate GKE app module/app root
• Adds customer handoff docs for the GCP BYOC bootstrap boundary and deployment flow
• Marks sensitive credential-style outputs as sensitive without changing existing resource behavior