Fix issue with google_compute_backend_service IAP client secret @ update

[rileykarson]

Resolves an issue that some users were encountering tracked off-GitHub.

Terraform theoretically has all the information to diff correctly, but I couldn't get the mechanics of the diff working correctly. I tried to make a CustomizeDiff and tried a few things w/ that, if you'd be interested in taking a crack at it yourself I can explain them + why they didn't work offline (it's a lot of typing to explain here, just grungy state stuff)

The reason we can't use an approach like #1336 is that this field is updatable. We need to preserve the value in state, and can't store a hash because we need to send it back up during updates.

---

[all]

[terraform]

[terraform-beta]

[ansible]

[inspec]

[modular-magician]

I am a robot that works on MagicModules PRs!

I built this PR into one or more PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: hashicorp/terraform-provider-google-beta#401
depends: hashicorp/terraform-provider-google#2978

[nat-henderson]

This absolutely seems like one way to do it - the value is going to be in logs and in state, right? I think that's certainly the best (could be only?) way to go about it, but I wanted to make sure that users are okay with that.

[rileykarson]

Given how Terraform's state works, the only way to send the field at update time is by recording it. It will be recorded in state and logs, and will not appear at plan time as it's sensitive.