Add bucket_policy_only to storage_bucket

[tysen]

Fixes hashicorp/terraform-provider-google#3073

I decided to make bucket_policy_only a top level field because the IamConfiguration block is always returned by the API (even when not provided) and we can't do defaults for complex objects. Happy to know a better way though.

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
This PR seems not to have generated downstream PRs before, as of 469a95d.

Pull request statuses

No diff detected in terraform-google-conversion.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: hashicorp/terraform-provider-google-beta#809
depends: hashicorp/terraform-provider-google#3783

[rileykarson]

Code LGTM- do you think it's worth noting in the docs that bucket_policy_only can't be disabled under most circumstances? Or adding a CustomizeDiff to ForceNew if a user tries to? https://cloud.google.com/storage/docs/bucket-policy-only#reversion

As-is, if you create a bucket with policy only on and then try to disable it, Terraform will error out instead of disabling it. Users will need to reconcile manually which is unfortunate but not necessarily a blocker.

[tysen]

I don't think ForceNew is a good idea because the field can be reverted for some time after it is set, and Terraform will properly handle it during that time. I think the link provided in the docs provides sufficient information re: the implications of the field.