put ConflictsWith on blocks that changed from ExactlyOneOf to AtLeastOneOf

[danawillow]

#2837 changed a bunch of ExactlyOneOfs to AtLeastOneOfs, which broke a HealthCheck test that confirmed that we fail when setting two of the conflicting fields (because it started failing API-side instead of at plan-time).

When I checked what we had been doing before ExactlyOneOf (so I could grab the right error message), they had all been ConflictsWith, and since AtLeastOneOf + ConflictsWith = ExactlyOneOf, this actually gives us back ExactlyOneOf behavior but without the issues with dynamic blocks.

Technically this is a breaking change, but since it's just moving an API-side failure to a plan-time one (and there was only one release where the restrictions went away), I'm fine with including it in a minor release.

Release Note Template for Downstream PRs (will be copied)

compute: Added back ConflictsWith restrictions for ExactlyOneOf restrictions that were removed in v3.3.0 for `google_compute_firewall`, `google_compute_health_check`, and `google_compute_region_health_check`. This effectively changes an API-side failure that was only accessible in v3.3.0 to a plan-time one.

resourcemanager: Added back ConflictsWith restrictions for ExactlyOneOf restrictions that were removed in v3.3.0 for `google_organization_policy`, `google_folder_organization_policy`, and `google_project_organization_policy`. This effectively changes an API-side failure that was only accessible in v3.3.0 to a plan-time one.

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, a8c0918.

Pull request statuses

No diff detected in terraform-google-conversion.
No diff detected in Inspec.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: hashicorp/terraform-provider-google-beta#1534
depends: hashicorp/terraform-provider-google#5220
depends: ansible-collections/google.cloud#116

[paddycarver]

This seems like a reasonable workaround to me, as long as it works with dynamic blocks!

[danawillow]

+alex for ansible

[rambleraptor]

I'm comfortable with this change as well