GCP-3125: Support Additional Roles/APIs For Integration QuickStart

[tedkahwaji]

Summary

The following change adds support for including additional roles and APIs to the service account created during the integration quick-start flow. This is intended for downstream products that require permissions beyond those needed for the baseline GCP integration. The UI will maintain the mapping of downstream productID → required APIs and roles. While this mapping will eventually be retrieved via an API, it is currently hard-coded.

I made the decision to send this data during user selection rather than embedding a static mapping in the script. Since the UI already needs this mapping for the Terraform flow, keeping it in one place avoids the need to continually synchronize the script and the UI.

Also when implementing the log forwarding script, the gcloud command was updated to support a builder component that constructs the required arguments for the command. This change updates all usages of the gcloud function to use these builders.

Testing

Tested by updating the UI locally to provide the necessary product requirements for llm-observability and running the script locally

https://drive.google.com/file/d/1inZM0vt7hVUbk9j8_gixuwnF5kKy9-q4/view?usp=sharing

[thekevinhuang]

I think this looks good to me. Did want to note that this does put the onus on the downstream product team to supply the correct api/permissions (and the eventual code reviewer to confirm that those do exist).