refactor(gcp): workspace_deployment module

[ashkan-db]

• Uniform resource naming: ${resource_prefix}--${deployment_suffix}
• Add serverless workspace support (compute_mode = SERVERLESS)
• Add flexible DNS for PSC: create zone + records, use existing zone, or manual
• Add tunnel. DNS A-record for SCC relay (fixes cluster launch timeout)
• Add workspace hardening: IP access lists, verbose audit, DBFS browser off, 90-day tokens
• Add resource_owner admin assignment with skip_user_lookup for safe destroy
• Add use_cmek master flag; support creating fresh KMS keyring+key or reusing existing
• Replace deprecated default_catalog_name with databricks_default_namespace_setting
• Gate db_subnet_ingress firewall on !use_existing_vpc (BYO creates zero GCP resources)
• Decouple Databricks VPC endpoint registration from use_existing_vpc
• Fix network_name exceeding 30-char Databricks API limit
• Fix DNS record count depending on computed attributes (plan-time error)
• Comment out GCS backend in examples (default to local state)
• Bump Databricks provider to >=1.113.0
• Update end-to-end example: enable PSC + CMEK + hardened network
• Document googleapis.com DNS zone prerequisite for PSC + hardened network

[AleksCallebat]

great job - 2 small issues ;

• one bit I don't understand and am afraid it's missing (causing potential errors at use if the uuid is not specified).
• one bit where the firewall rule is not defined in the right place

[AleksCallebat]

Which part generates the deployment_suffix in case it's empty in the tfvars? We need to validate that if it's empty the suffix is generated via uuid as advertised

[AleksCallebat]

This will make the rule empty by default (nobody will scroll till there)
Need to :

1. Add a variable which are the ip-domain
2. Add this link to documentation as part of the var file

Conscious this is a default previous version already had