ensure dns_keys output freshness

[nathou]

When making changes to the dnssec_config of the dns module, the dns_keys output is retrieved before the changes to the dns zone.
Not only this means it takes two terraform apply to converge, but this is an issue when you enable dnssec and expect to find a ds_record in the output (to create a DS recordset).

For example, create a test public zone without dnssec enabled:

module "dns" {
  source     = "[email protected]:GoogleCloudPlatform/cloud-foundation-fabric.git//modules/dns"
  project_id = "my-dns-keys-test-project"
  name       = "my-test-zone"

  zone_config = {
    domain = "testkeys.example.com."
    public = {
      enable_logging = false
    }
  }
}

output "keys" {
  value = module.dns.dns_keys
}

This outputs the following, as expected:

keys = []

Then, enable dnssec:

     public = {
       enable_logging = false
+      dnssec_config = {
+        state = "on"
+      }
     }

After one run, the output changes because the dnssec state variable is now "on", but the keys themselves are null:

keys = [
  {
    "id" = "projects/my-dns-keys-test-project/managedZones/my-test-zone"
    "key_signing_keys" = tolist(null) /* of object */
    "managed_zone" = "projects/my-dns-keys-test-project/managedZones/my-test-zone"
    "project" = "my-dns-keys-test-project"
    "zone_signing_keys" = tolist(null) /* of object */
  },
]

A second run finally updates the output:

keys = [
  {
    "id" = "projects/my-dns-keys-test-project/managedZones/my-test-zone"
    "key_signing_keys" = tolist([
      {
        "algorithm" = "rsasha256"
        "creation_time" = "2024-08-09T12:44:57.244Z"
        "description" = ""
        "digests" = tolist([
          {
            "digest" = "2ECD30852EDE31D95BCBB511DC2701153038255EC0E0B1827AF3A2CFCD121C07"
            "type" = "sha256"
          },
        ])
        "ds_record" = "722 8 2 2ECD30852EDE31D95BCBB511DC2701153038255EC0E0B1827AF3A2CFCD121C07"
        "id" = "0"
        "is_active" = true
[...]
      },
    ])
    "managed_zone" = "projects/my-dns-keys-test-project/managedZones/my-test-zone"
    "project" = "my-dns-keys-test-project"
    "zone_signing_keys" = tolist([
      {
        "algorithm" = "rsasha256"
        "creation_time" = "2024-08-09T12:44:57.430Z"
        "description" = ""
        "digests" = tolist([])
        "id" = "1"
        "is_active" = true
[...]
    ])
  },
]

With the dependency, the dns_keys are retrieved after the zone is modified, and the output contains the keys from the first apply.

---

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass