Add CloudSQL permissions to github action service account

[ohrite]

Description

This PR moves CloudSQL permissions from the terraform service account mainly used in the data-infra repo to the github actions service account mainly used in external repositories

Relates to cal-bc#37

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation

How has this been tested?

terraform plan

Post-merge follow-ups

• No action required
• Actions required (specified below)

Monitor terraform apply output

[github-actions]

Terraform plan in iac/cal-itp-data-infra-staging/iam/us

Plan: 2 to add, 0 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-   destroy

Terraform will perform the following actions:

  # google_project_iam_member.github-actions-service-account["roles/cloudsql.admin"] will be created
+   resource "google_project_iam_member" "github-actions-service-account" {
+       etag    = (known after apply)
+       id      = (known after apply)
+       member  = "serviceAccount:github-actions-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com"
+       project = "cal-itp-data-infra-staging"
+       role    = "roles/cloudsql.admin"
    }

  # google_project_iam_member.github-actions-service-account["roles/run.admin"] will be created
+   resource "google_project_iam_member" "github-actions-service-account" {
+       etag    = (known after apply)
+       id      = (known after apply)
+       member  = "serviceAccount:github-actions-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com"
+       project = "cal-itp-data-infra-staging"
+       role    = "roles/run.admin"
    }

  # google_project_iam_member.github-actions-terraform["roles/cloudsql.admin"] will be destroyed
  # (because key ["roles/cloudsql.admin"] is not in for_each map)
-   resource "google_project_iam_member" "github-actions-terraform" {
-       etag    = "BwZBYIkooFs=" -> null
-       id      = "cal-itp-data-infra-staging/roles/cloudsql.admin/serviceAccount:github-actions-terraform@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       member  = "serviceAccount:github-actions-terraform@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       project = "cal-itp-data-infra-staging" -> null
-       role    = "roles/cloudsql.admin" -> null
    }

Plan: 2 to add, 0 to change, 1 to destroy.

📝 Plan generated in Terraform Plan #588