feat: support existing Shared VPC and GKE for GCP BYOC-I

[haorenfsa]

Summary

• add optional existing_network and existing_gke inputs for GCP BYOC-I
• read and validate customer-owned Shared VPC, subnets, regional private GKE, and required node pools without importing them into state
• reuse the existing GKE node service account while continuing to manage required IAM grants
• create PSC endpoint resources in the service project and bind Shared VPC/DNS resources through the host project
• preserve the default managed VPC/GKE path and add moved blocks for state address compatibility
• document prerequisites, constraints, and managed-to-existing migration risk

Tests

• terraform test -filter=tests/default.tftest.hcl in examples/gcp-project-byoc-I: 3 passed
• terraform validate in examples/gcp-project-byoc-I
• terraform validate in modules/gcp_byoc_i/iam
• terraform validate in modules/gcp_byoc_i/private-link
• terraform fmt -check -recursive on changed Terraform directories
• git diff --check

Remaining validation

A live GCP apply was not run. Shared VPC usage still requires the customer to preconfigure host/service project IAM and relevant APIs.