feat(project-factory): introduce additive iam bindings to project-fac…

[Malet]

…tory

[Malet]

This PR attempts to solve the issue of setting base IAM permissions for each group, for example:

group_iam_additive:
  gcp-foo-devops@bar.com:
    - roles/viewer
  gcp-foo-mlops@bar.com:
    - roles/viewer
  gcp-foo-data-engineers@bar.com:
    - roles/editor
  gcp-foo-platform-developers@bar.com:
    - roles/viewer

Whilst still allowing other teams with their own terraform repos (which are referring to a project-factory created project), to manage their own IAM permissions for service accounts.

[ludoo]

Thanks for this!