[codex] Add h2c bulk backend for GCP installer transfers

[robbiet480]

Summary

Cloud Run's HTTP/1 request body and non-streaming response limits make large Fleet software installer upload/download paths fail unless the whole Fleet service is forced to h2c. That global workaround breaks connection upgrades, which affects WebSocket-dependent Fleet features.

This adds a second Cloud Run service for large software installer transfer paths and forces only that service to h2c. The primary Fleet service remains on the existing fleet_config.use_h2c setting, so normal UI/API/WebSocket traffic can stay on HTTP/1 while byte-heavy package paths route through the h2c backend.

Changes

• Add a fleet-api-bulk Cloud Run service using the same image, service account, VPC, resources, and secrets as the primary Fleet service, with FLEET_SERVER_FORCE_H2C=true and an h2c container port.
• Add a serverless NEG and load balancer backend for the bulk service.
• Manage a custom URL map so Fleet software installer upload/download paths route to the bulk backend while all other paths use the default backend.
• Update the GCP README limitation/workaround text to document the per-path h2c behavior.

Validation

• terraform fmt gcp/byo-project/cloud_run.tf gcp/byo-project/loadbalancer.tf
• terraform -chdir=gcp validate

[BCTBB]

@robbiet480 Thank you for your contribution! We'll schedule the review of your proposed changes for next sprint.