fix(gcp): split custom-role permissions by scope

[vik-nullify]

Summary

• Single-project (scope = "projects" with no organization_id) installs of the GCP cloud connector were failing at apply with Permission accesscontextmanager.accessPolicies.get is not valid. because Access Context Manager and Org Policy permissions are only includable in organisation-scoped custom roles.
• Splits custom_role_permissions into _common (project + org safe, 24 perms) and _org_only (accesscontextmanager.* + orgpolicy.*, 6 perms). The org-scoped role concats both; the project-scoped role uses only _common. Single-project installs have no VPC SC or org-policy data to read at project scope, so this is functionally a no-op for them.
• Adds an explicit depends_on = [google_project_service.required] to the project-scoped google_project_iam_custom_role, matching the dependency pattern already used by the SA / WIF pool / WIF provider in the same module. Closes a fresh-project race where the role could be created before iam.googleapis.com is enabled.
• docs/permissions.md flags the org-only permissions with * and a footnote.

Repro of the original failure

module "nullify_gcp_integration" {
  source          = "../../modules/nullify-gcp-integration"
  customer_name   = "..."
  host_project_id = var.gcp_project_id
  scope           = "projects"
  project_ids     = [var.gcp_project_id]
  # no organization_id
  ...
}

│ Error: Error creating the custom project role projects/<proj>/roles/nullifyCloudConnector:
│ googleapi: Error 400: Permission accesscontextmanager.accessPolicies.get is not valid., badRequest

Test plan

• terraform validate passes for examples/single-project, examples/folder, examples/organization and the local single-project test rig
• terraform fmt -check passes on changed files
• CI (terraform-validate.yml) — covered by the workflow's existing matrix
• End-to-end re-apply on the failing single-project install to confirm the role now creates and binds cleanly

Notes

• No change to org-scoped or folder-scoped installs — they still receive the full permission set.
• No new variables, no breaking changes to module inputs/outputs.