feat(google_permissions): Allow roles/datastore.user for folder, nonprod, and prod roles

[jbuck]

Description

This PR allows roles/datastore.user for folder, nonprod, and prod roles. I decided on a slightly different implementation scheme that should be a bit easier for CEs to manage roles. I could also move the existing resource blocks to use this instead, if that's desired.

Related Tickets & Documents

• MZCLD-2439

[github-actions]

Release plan

Directory	Previous version	New version
google_permissions	0.5.0	0.6.0

[whd]

I could also move the existing resource blocks to use this instead, if that's desired.

I think that will be overall less confusing but will produce minor confusion in the short term i.e. you will probably want to manually roll this out everywhere if you do this and while you probably should, I can see the argument for letting dependabot handle the easy upgrade and save proper refactoring for when we've done upstream work to facilitate that like https://mozilla-hub.atlassian.net/browse/MZCLD-2140

[whd]

r+wc

I strongly recommend updating https://github.com/mozilla/terraform-modules/blob/main/google_permissions/ADDING_NEW_ROLE.md if this is the new preferred way to add roles.

[whd]

Suggested change

	for x in var.nonprod_roles : contains(local.project_additional_roles, x) || contains(local.allowed_prod_roles, x)
	for x in var.nonprod_roles : contains(local.project_additional_roles, x) || contains(local.allowed_nonprod_roles, x)

[whd]

If there's a high probability we keep these lists synced it makes sense to deduplicate here. But that gets into the general structure of this module which is not a topic we want to get into.

[jbuck]

Yeah, I think as part of the refactoring of existing roles into using local.allowed_folder_roles, local.allowed_nonprod_roles, and local.allowed_prod_roles that would be a good time to remove this list

[jbuck]

Er whoops, misread the context. I kept the original design where roles could be allowed at separate levels

[whd]

Suggested change

	for x in var.nonprod_roles : contains(local.project_additional_roles, x) || contains(local.allowed_prod_roles, x)
	for x in var.nonprod_roles : contains(local.project_additional_roles, x) || contains(local.allowed_nonprod_roles, x)

[whd]

r+ the docs simplification though I have a bit of a hard time following the lines preliminary to the changes.