⭐ GCP: Add Cloud Armor, SSL, Cloud NAT, CAS, Audit Config, and Org Policy resources

[tas50]

Add security-focused resources to the GCP provider covering WAF/DDoS protection, TLS configuration, NAT auditing, private PKI, audit logging, and org policy enforcement.

New resources:

Cloud Armor:

• gcp.project.computeService.securityPolicy: id, name, description, type, labels, adaptiveProtectionConfig, advancedOptionsConfig, ddosProtectionConfig, recaptchaOptionsConfig, regionUrl, selfLink, createdAt, rules()
• gcp.project.computeService.securityPolicy.rule: id, action, description, priority, preview, match, networkMatch, rateLimitOptions, redirectOptions, headerAction, preconfiguredWafConfig

SSL Policies:

• gcp.project.computeService.sslPolicy: id, name, description, profile, minTlsVersion, customFeatures, enabledFeatures, regionUrl, selfLink, warnings, createdAt

SSL Certificates:

• gcp.project.computeService.sslCertificate: id, name, description, type, subjectAlternativeNames, managed, regionUrl, selfLink, expireTime, createdAt

Cloud NAT:

• gcp.project.computeService.router.nat: id, name, natIpAllocateOption, sourceSubnetworkIpRangesToNat, enableDynamicPortAllocation, enableEndpointIndependentMapping, minPortsPerVm, maxPortsPerVm, natIps, subnetworks, rules, logConfig, endpointTypes, autoNetworkTier, icmpIdleTimeoutSec, tcpEstablishedIdleTimeoutSec, tcpTransitoryIdleTimeoutSec, tcpTimeWaitTimeoutSec, udpIdleTimeoutSec
• router.natServices field added (router.nats []dict preserved as deprecated)

Certificate Authority Service:

• gcp.project.certificateAuthorityService: projectId, caPools()
• gcp.project.certificateAuthorityService.caPool: projectId, resourcePath, name, location, tier, issuancePolicy, publishingOptions, labels, certificateAuthorities(), certificates()
• gcp.project.certificateAuthorityService.certificateAuthority: projectId, resourcePath, name, location, caPool, type, state, keySpec, config, lifetime, pemCaCertificates, subordinateConfig, labels, gcsBucket, accessUrls, createdAt, updatedAt, deletedAt, expireTime
• gcp.project.certificateAuthorityService.certificate: projectId, resourcePath, name, location, caPool, issuerCertificateAuthority, lifetime, subjectDescription, certDescription, pemCertificate, pemCertificateChain, revocationDetails, labels, createdAt, updatedAt

Audit Logging Configuration:

• gcp.resourcemanager.auditConfig: id, service, auditLogConfigs
• gcp.resourcemanager.auditConfig.logConfig: id, logType, exemptedMembers
• Exposed on both gcp.organization and gcp.project

Organization Policies:

• gcp.orgPolicy: id, name, constraintName, spec, dryRunSpec, etag, updatedAt
• Exposed on both gcp.organization and gcp.project

[mondoo-code-review]

Well-structured additions with comprehensive security resource coverage; pagination not handled but consistent with existing patterns

[github-actions]

Test Results

5 136 tests  +24   5 132 ✅ +24   1m 57s ⏱️ -2s
  409 suites ± 0       4 💤 ± 0 
   31 files   ± 0       0 ❌ ± 0 

Results for commit 2ef100b. ± Comparison against base commit 2a19947.

♻️ This comment has been updated with latest results.