Add custom tag support to FAST

[ludoo]

This adds support for a custom tag hierarchy to FAST stage 1, and includes simple aliasing to refer to the internally created IaC service accounts in tag value bindings.

tags = {
  org-policies = {
    description = "Tag values used in organization policy conditions."
    values = {
      drs-allow-all = {
        description = "Allow all in Domain Restricted Sharing."
        iam = {
          "roles/resourcemanager.tagUser" = ["sandbox"]
        }
      }
    }
  }
}

It also creates a new tag key that forms the base of the hierarchy of tag values for org policy conditions. This has a single default value for "DRS all" but can be extended by using the same tag key name in the custom variable shown above.

[juliocc]

🤯