refactor: one default common perimeter

[mariammartins]

This PR contains the refactoring of VPC Service Controls, with the creation of a single common perimeter, with all projects inserted in it, with the exception of the cloud build project.

[mariammartins]

/gemini review

[gemini-code-assist]

Code Review

This pull request refactors the VPC Service Controls to use a single, common perimeter, which is a positive architectural simplification. The changes are extensive, touching documentation, Terraform configurations, and helper scripts to align with this new model. However, the implementation introduces some significant issues. There's a critical conflict in the Cloud Build private pool networking where both a managed Cloud NAT and a self-managed NAT VM are configured, which needs to be resolved. More importantly, the new perimeter configuration relies on placeholders in the Terraform code that must be manually updated using scripts in a later step. This approach is brittle, error-prone, and undermines the declarative nature of Infrastructure as Code. I've raised a critical issue to address this architectural flaw. Additionally, there are medium-severity concerns regarding hardcoded IP ranges and the use of a git branch reference instead of a specific tag or commit for a module source.

[mariammartins]

/gemini review

[gemini-code-assist]

Code Review

This pull request is a significant and valuable refactoring of the VPC Service Controls implementation. By centralizing the configuration and creating a single common perimeter, it greatly simplifies the architecture and improves maintainability. The changes across the various stages to support this new model are comprehensive. My review focuses on a few areas for improvement, mainly around security hardening, documentation accuracy, and maintainability of the new Terraform configurations.

[daniel-cit]

@eeaton Could you PTAL?