Drop the resources we can't support.

IAP has no reasonable support policy, because PATCH is broken, and IAP
must be configured with an OAuth2 client ID and secret that belongs to
the project the app is associated with. There's no programmatic way to
create Clients. But we create the project and the app at the same time,
and we can't update because PATCH is broken. So this just drops IAP. It
also forces all our updates to ForceNew, because we can't update.

Also, adds more test coverage and docs, and fixes import by not relying
on the config for setting app engine info in state.

docs/r/google_project.html.markdown

@@ -61,6 +61,20 @@ resource "google_folder" "department1" {
 }
 ```
 
+To create a project with an App Engine app attached
+
+```hcl
+resource "google_project" "my-app-engine-app" {
+  name = "App Engine Project"
+  project_id = "app-engine-project"
+  org_id = "1234567"
+
+  app_engine {
+    location_id = "us-central"
+  }
+}
+```
+
 ## Argument Reference
 
 The following arguments are supported:
@@ -103,6 +117,19 @@ The following arguments are supported:
     name to match the GCP Console UI. Setting this field to false will enable the Compute Engine
     API which is required to delete the network.
 
+* `app_engine` - (Optional) A block of configuration to enable an App Engine app. Setting this
+   field will enabled the App Engine Admin API, which is required to manage the app.
+
+The `app_engine` block has the following configuration options:
+
+* `location_id` - (Required) The [location](https://cloud.google.com/appengine/docs/locations<Paste>)
+   to serve the app from.
+* `auth_domain` - (Optional) The domain to authenticate users with when using App Engine's User API.
+* `serving_status` - (Optional) The serving status of the app. Note that this can't be updated at the moment.
+* `feature_settings` - (Optional) A block of optional settings to configure specific App Engine features:
+  * `split_health_checks` - (Optional) Set to false to use the legacy health check instead of the readiness
+    and liveness checks.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are
@@ -115,6 +142,13 @@ exported:
     `etag` property instead; future versions of Terraform will remove the `policy_etag`
     attribute
 
+* `app_engine.0.name` - Unique name of the app, usually `apps/{PROJECT_ID}`
+* `app_engine.0.url_dispatch_rule` - A list of dispatch rule blocks. Each block has a `domain`, `path`, and `service` field.
+* `app_engine.0.code_bucket` - The GCS bucket code is being stored in for this app.
+* `app_engine.0.default_hostname` - The default hostname for this app.
+* `app_engine.0.default_bucket` - The GCS bucket content is being stored in for this app.
+* `app_engine.0.gcr_domain` - The GCR domain used for storing managed Docker images for this app.
+
 ## Import
 
 Projects can be imported using the `project_id`, e.g.