⭐ GCP: Add Cloud Armor, SSL, Cloud NAT, CAS, Audit Config, and Org Policy resources

Add security-focused resources to the GCP provider covering WAF/DDoS protection,
TLS configuration, NAT auditing, private PKI, audit logging, and org policy enforcement.

New resources:

Cloud Armor:
- gcp.project.computeService.securityPolicy: id, name, description, type, labels,
  adaptiveProtectionConfig, advancedOptionsConfig, ddosProtectionConfig,
  recaptchaOptionsConfig, regionUrl, selfLink, createdAt, rules()
- gcp.project.computeService.securityPolicy.rule: id, action, description, priority,
  preview, match, networkMatch, rateLimitOptions, redirectOptions, headerAction,
  preconfiguredWafConfig

SSL Policies:
- gcp.project.computeService.sslPolicy: id, name, description, profile, minTlsVersion,
  customFeatures, enabledFeatures, regionUrl, selfLink, warnings, createdAt

SSL Certificates:
- gcp.project.computeService.sslCertificate: id, name, description, type,
  subjectAlternativeNames, managed, regionUrl, selfLink, expireTime, createdAt

Cloud NAT:
- gcp.project.computeService.router.nat: id, name, natIpAllocateOption,
  sourceSubnetworkIpRangesToNat, enableDynamicPortAllocation,
  enableEndpointIndependentMapping, minPortsPerVm, maxPortsPerVm, natIps,
  subnetworks, rules, logConfig, endpointTypes, autoNetworkTier,
  icmpIdleTimeoutSec, tcpEstablishedIdleTimeoutSec, tcpTransitoryIdleTimeoutSec,
  tcpTimeWaitTimeoutSec, udpIdleTimeoutSec
- router.natServices field added (router.nats []dict preserved as deprecated)

Certificate Authority Service:
- gcp.project.certificateAuthorityService: projectId, caPools()
- gcp.project.certificateAuthorityService.caPool: projectId, resourcePath, name,
  location, tier, issuancePolicy, publishingOptions, labels,
  certificateAuthorities(), certificates()
- gcp.project.certificateAuthorityService.certificateAuthority: projectId,
  resourcePath, name, location, caPool, type, state, keySpec, config, lifetime,
  pemCaCertificates, subordinateConfig, labels, gcsBucket, accessUrls,
  createdAt, updatedAt, deletedAt, expireTime
- gcp.project.certificateAuthorityService.certificate: projectId, resourcePath,
  name, location, caPool, issuerCertificateAuthority, lifetime,
  subjectDescription, certDescription, pemCertificate, pemCertificateChain,
  revocationDetails, labels, createdAt, updatedAt

Audit Logging Configuration:
- gcp.resourcemanager.auditConfig: id, service, auditLogConfigs
- gcp.resourcemanager.auditConfig.logConfig: id, logType, exemptedMembers
- Exposed on both gcp.organization and gcp.project

Organization Policies:
- gcp.orgPolicy: id, name, constraintName, spec, dryRunSpec, etag, updatedAt
- Exposed on both gcp.organization and gcp.project

Signed-off-by: Tim Smith <tsmith84@gmail.com>

Author: tas50

.github/actions/spelling/expect.txt

@@ -38,7 +38,7 @@ databricks
 datapath
 DATAUSER
 datetime
-Ddos
+ddos
 deliverychannel
 dfw
 dlp
@@ -138,6 +138,7 @@ psc
 pushconfig
 querypack
 ratebasedstatement
+recaptcha
 regexmatchstatement
 regexpatternsetreferencestatement
 resourcegroup
@@ -176,7 +177,6 @@ timestream
 toplevel
 tpu
 serviceconnection
-Vnet
 udid
 Uocm
 usb

providers/gcp/go.mod

@@ -18,10 +18,12 @@ require (
 	cloud.google.com/go/logging v1.13.1
 	cloud.google.com/go/longrunning v0.8.0
 	cloud.google.com/go/monitoring v1.24.3
+	cloud.google.com/go/orgpolicy v1.15.1
 	cloud.google.com/go/pubsub v1.50.1
 	cloud.google.com/go/recommender v1.13.6
 	cloud.google.com/go/redis v1.18.3
 	cloud.google.com/go/run v1.15.0
+	cloud.google.com/go/security v1.19.2
 	cloud.google.com/go/serviceusage v1.9.7
 	cloud.google.com/go/spanner v1.87.0
 	github.com/aws/smithy-go v1.24.0
@@ -285,7 +287,7 @@ require (
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260122232226-8e98ce8d340d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
-	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/grpc v1.79.1
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	howett.net/plist v1.0.1 // indirect

providers/gcp/go.sum

@@ -76,6 +76,8 @@ cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7
 cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
 cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
 cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
+cloud.google.com/go/orgpolicy v1.15.1 h1:0hq12wxNwcfUMojr5j3EjWECSInIuyYDhkAWXTomRhc=
+cloud.google.com/go/orgpolicy v1.15.1/go.mod h1:bpvi9YIyU7wCW9WiXL/ZKT7pd2Ovegyr2xENIeRX5q0=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -92,6 +94,8 @@ cloud.google.com/go/run v1.15.0 h1:4cwyNv9SUQEsQOf5/DfPKyMWYSA52p38/o119BgMhO4=
 cloud.google.com/go/run v1.15.0/go.mod h1:rgFHMdAopLl++57vzeqA+a1o2x0/ILZnEacRD6nC0EA=
 cloud.google.com/go/secretmanager v1.16.0 h1:19QT7ZsLJ8FSP1k+4esQvuCD7npMJml6hYzilxVyT+k=
 cloud.google.com/go/secretmanager v1.16.0/go.mod h1://C/e4I8D26SDTz1f3TQcddhcmiC3rMEl0S1Cakvs3Q=
+cloud.google.com/go/security v1.19.2 h1:cF3FkCRRbRC1oXuaGZFl3qU2sdu2gP3iOAHKzL5y04Y=
+cloud.google.com/go/security v1.19.2/go.mod h1:KXmf64mnOsLVKe8mk/bZpU1Rsvxqc0Ej0A6tgCeN93w=
 cloud.google.com/go/serviceusage v1.9.7 h1:vrBBeI2ESmri4BLGPz1YH2o37loIQ3DDTloYiDOe2lY=
 cloud.google.com/go/serviceusage v1.9.7/go.mod h1:JpBpv+4Zbe7+RiC9ydc6xgBUOntIL9tA85d2xKgV83g=
 cloud.google.com/go/spanner v1.87.0 h1:M9RGcj/4gJk6yY1lRLOz1Ze+5ufoWhbIiurzXLOOfcw=
@@ -569,8 +573,6 @@ github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
-github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=