feat(gcp-byoc-i): support existing infrastructure and GKE encryption

[wenhuiZilliz]

Summary

Existing and Shared VPC networking

• support creating or reusing an existing VPC
• support creating or reusing primary and proxy-only subnets
• support regular VPC and Shared VPC host/service project layouts
• add scoped Shared VPC service-agent IAM bindings
• provide independent switches for Cloud NAT, firewall rules, and Shared VPC IAM management
• preserve existing VPCs and subnets during terraform destroy

GKE Secrets encryption

• support GKE application-layer Secrets encryption with Cloud KMS
• create a regional KMS key automatically or use an existing key
• optionally manage the GKE service agent's key-level IAM binding
• validate that an existing KMS key is in the GKE region

Existing GKE clusters

• add gke_mode = "existing" to reuse a customer-managed regional GKE cluster
• create dedicated BYOC-I node pools in the existing cluster; reusing existing node pools is not supported
• validate VPC-native networking, VPC, subnet, Pod and Service secondary ranges, private nodes, and Workload Identity
• validate the configured Secrets encryption key when encryption validation is enabled
• preserve the existing cluster during terraform destroy while removing Terraform-managed BYOC-I node pools
• migrate the existing Terraform cluster state address after introducing conditional cluster creation

Documentation

• document network and GKE modes, required IAM permissions, configuration examples, and destroy behavior

Validation

• terraform validate
• git diff --check
• terraform plan -refresh=false for the default create-network mode
• terraform plan -refresh=false for an existing VPC with new subnets
• validation failure for an existing subnet without the required secondary ranges
• Shared VPC IAM module plan

[huanghaoyuanhhy]

/lgtm